Satan Is on My Friends List

Architecture and Background

DEF CON 16 - Nathan Hamiel & Shawn Moyer: Satan is on my Friends list: Attacking Social Networks Social Networking is shaping up to be the perfect storm... An implicit trust of those in one's network or social circle, a willingness to share information, little or no validation of identity, the ability to run arbitrary code (in the case of user-created apps) with minimal review, and a tag soup of client-side user-generated HTML (Hello? MySpace?

Vulnerability Analysis

1998 called. It wants its markup vulns back). Yikes.

Exploitation and Demonstrations

But enough about pwning the kid from homeroom who copied your calc homework. With the rise of business social networking sites, there are now thousands of public profiles with real names and titles of people working for major banks, the defense and aerospace industry, federal agencies, the US Senate... A target-rich and trusting environment for custom-tailored, laser-focused attacks.

Remediation and Defensive Strategies

Our talk will show the results of a series of public experiments aimed at pointing out the security and privacy ramifications of everyone's increasingly open, increasingly connected online personae and the interesting new attack vectors they've created. Plus, we get to have some fun violating scads of EULAs, AUPs, and Terms of Service along the way. K. THX FOR THE ADD!!1!