Social Networks Research Aspects: A Vast and Fast Survey Focused on the Issue of Privacy in Social Network Sites <s> 17-2-2 Attacking Access Limited Information <s> In a social network, nodes correspond topeople or other social entities, and edges correspond to social links between them. In an effort to preserve privacy, the practice of anonymization replaces names with meaningless unique identifiers. We describe a family of attacks such that even from a single anonymized copy of a social network, it is possible for an adversary to learn whether edges exist or not between specific targeted pairs of nodes. <s> BIB001 </s> Social Networks Research Aspects: A Vast and Fast Survey Focused on the Issue of Privacy in Social Network Sites <s> 17-2-2 Attacking Access Limited Information <s> Social networking services well know that some users are unwilling to freely share the information they store with the service (e.g. profile information). To address this, ser vices typically provide various privacy "knobs" that the user may adjust to limit access by content type or user identity. However, the main purpose of social networks, community building, is largely at odds with this, hence it is unsurprising that privacy breaches in social networks are increasingly discovered. We argue that this tension between social networking goals and privacy suggests that research efforts should be focused more on efficient methods for detecting privacy breaches in social networks and on building user awareness of privacy risks and the trade-off between privacy and utility. We support our argument with a simple method for discovering LinkedIn contacts ostensibly hidden by privacy settings. This method appears discoverable with a straightforward analysis of the LinkedIn system and its features (indeed, LinkedIn is likely aware of this method), however Linkedin's privacy instructions suggest to users that implementing a privacy setting will prevent such discovery. <s> BIB002
Using the facilities which users are given, to adjust how their information could be accessed, they can make their information not to be accessible by everyone, and specify different limitations for different parts of their information, for example a person may set her pictures to only be viewable by her close friends. Attackers certainly would try to cross these borders. In [67] "social link forging attacks" and "node identity forging attacks" are mentioned. The former means deceiving a user and convincing her to establish a link (may include impersonating one of her friends by the attacker), the latter means creating several fake identities and pretending to have several personalities in a SNS. In BIB002 a breach is detected in linkedIn, and using the presented method the contacts of a victim are extracted. Increasing the credibility of phishers' messages using the credibility of people who are connected with the victim is noted as a motivation for this kind of attacks. Some more complicated attacks are also cited in this paper. In BIB001 a type of attack called "automated identity theft" along with its two subtypes called "profile cloning" and "cross-site profile cloning" is presented. In these attacks the attacker tries to make fake profiles which appear to belong to persons who really exist and have profiles either in the target SNS or other SNSs. In this study a prototype of an attack system for performing attacks is presented which performs crawling, users' information gathering, profile creation, message sending, and tries to break CAPTCHAs. Some experiments have been done on five social networks including facebook and linkedin. 