HackerPapers

arXiv:2006.15794cs.CY

CanaryTrap: Detecting Data Misuse by Third-Party Apps on Online Social Networks

Shehroze Farooqi, Maaz Musa, Zubair Shafiq, Fareed Zaffar

Abstract

Online social networks support a vibrant ecosystem of third-party apps that get access to personal information of a large number of users. Despite several recent high-profile incidents, methods to systematically detect data misuse by third-party apps on online social networks are lacking. We propose CanaryTrap to detect misuse of data shared with third-party apps. CanaryTrap associates a honeytoken to a user account and then monitors its unrecognized use via different channels after sharing it with the third-party app. We design and implement CanaryTrap to investigate misuse of data shared with third-party apps on Facebook. Specifically, we share the email address associated with a Facebook account as a honeytoken by installing a third-party app. We then monitor the received emails and use Facebook's ad transparency tool to detect any unrecognized use of the shared honeytoken. Our deployment of CanaryTrap to monitor 1,024 Facebook apps has uncovered multiple cases of misuse of data shared with third-party apps on Facebook including ransomware, spam, and targeted advertising.

arXiv comments
Journal reference
DOI
Subjects
cs.CYComputers and Society cs.SISocial and Information Networks

On Hacker News

Linked by 3 identifiable commenters in 3 comments across 2 threads, from Jul 2020 to Mar 2021. Found in 1 HN submission from Jul 2020 to Jul 2020. Open submission discussions.

Comments linking this paper, per year.

Discussed in comments2 threads

  1. Fake_contacts: Android app to create fake phone contacts, to do data-poisoning 1 comment

    • This is basically a mechanism that would allow for a honeytrap on steroids. https://blog.finjan.com/honeytokens-used-to-track-cybercrimi... > that would require keeping track of bogus submissions You don't have to keep track of the submissions because you can generate them with…

      ultimapeView on HNParent context

  2. CanaryTrap: Detecting data misuse by third-party apps on online social networks 2 comments

    • The research paper[1] contains a list of the 16 apps on page 11. [1] https://arxiv.org/pdf/2006.15794.pdf

      jshprentzView on HNParent context

    • Hello everyone, Lead author of the paper here. I am encouraged to see such insightful discussion on our work. Excited to discuss and address any questions/concerns that you anyone may have. A preprint of our full paper can be found here: https://arxiv.org/pdf/2006.15794.pdf. We…

      shehrozefView on HNParent context

Submitted to Hacker News

Connected through shared HN threads, not inferred similarity or a recommendation.