Consequences of Connectivity: Characterizing Account Hijacking on Twitter

In this study we expose the serious large-scale threat of crim-inal account hijacking and the resulting damage incurred by users and web services. We develop a system for detecting large-scale attacks on Twitter that identifies 14 million vic-tims of compromise. We examine these accounts to track how attacks spread within social networks and to determine how criminals ultimately realize a profit from hijacked cre-dentials. We find that compromise is a systemic threat, with victims spanning nascent, casual, and core users. Even brief compromises correlate with 21 % of victims never returning to Twitter after the service wrests control of a victim’s ac-count from criminals. Infections are dominated by social contagions—phishing and malware campaigns that spread along the social graph. These contagions mirror informa-tion diffusion and biological diseases, growing in virulence with the number of neighboring infections. Based on the severity of our findings, we argue that early outbreak detec-tion that stems the spread of compromise in 24 hours can spare 70 % of victims