Unintended disclosure of information: Inference attacks by third-party extensions to Social Network Systems

Abstract

Popularity of Social Network Systems (SNSs) has significantly increased in recent years, raising serious concerns for the privacy of users. Such concerns arise partly because SNS providers allow third-party extensions to access their users' information through an Application Programming Interface (API). Typical permission-based protection mechanisms restrict direct access to user data. However, once an extension has been authorized by a user to access some data in a user’s profile, there is no more control on how that extension uses the data. A malicious extension may try to infer other information based on the legitimately accessible information. If an extension is not supposed to know the inferred information, then this information leakage process is called an inference attack. Due to the large number of users who subscribe to third-party extensions in SNSs, even an inference attack with only a moderate success rate can put the privacy of a large number of users at risk. In addition, inference attacks are not only a privacy violation, they could also be used as the building blocks for more dangerous security attacks, such as identity theft and phishing attacks. In this work, we conduct a comprehensive empirical study to assess the feasibility and accuracy of inference attacks that are launched from the extension API of SNSs. We devise an analytical framework for assessing the success rate of sample inference attacks, and discuss two further attack scenarios in which inference attacks are employed as building blocks. The significance of this work is in thoroughly discussing how inference attacks could happen in practice via the extension API of SNSs, and highlighting the clear and present danger of even the naively crafted inference attacks.