An in-depth analysis of abuse on Twitter

### Overview Presented by Jonathan Oliver and Paul Pajares on behalf of Trend Micro and Deakin University (supported by an Australian government grant), this talk explores large-scale spam, phishing, and abuse campaigns on Twitter. Driven by findings such as research from the RAND Corporation showing that social network accounts hold greater value on the underground economy than credit card accounts, cybercriminals increasingly leverage social platforms for high computational and monetary return.

### Key Topics The speakers analyzed massive abuse operations rather than isolated events, identifying three major categories: - **Voluminous Spam and Copyright Infringement:** Distribution of junk goods, cracked software, and unauthorized media links, heavily dominated by Russian and Eastern European spam clusters. - **Direct Message Phishing:** Viral credential theft utilizing deceptive messages from contacts to harvest login credentials. - **Twitter Follower Scams:** Fraudulent services promising followers or engagement while tricking victims into granting extensive account authorization or paying subscription fees.

### Technical Details - **Dataset & Graph Analysis:** Examining approximately 500 million tweets captured over a two-week period in September of the prior year, the researchers identified 33 million malicious/spam tweets, establishing a 5.8% spam rate among tweets containing URLs. To process half a billion tweets without manual review, researchers identified bipartite clique structures (and approximate bipartite cliques) representing round-robin distribution schemes where coordinated sender sets blasted messages to coordinated target domains, even when obfuscated behind URL shorteners. Twitter subsequently suspended roughly 34,000 senders from these identified groups. - **Coordination & Click-Through Rates:** Analysis revealed precise coordination between groups (e.g., Group A sending up to 120,000 tweets per hour across 797 senders before handing off directly to Group E within the same hour). Data drawn from Trend Micro’s Smart Protection Network (SPN) revealed click-through rates exponentially higher than traditional email spam. Additionally, Paul Walters' cited research showed that 46% of advertising on copyright-infringing target sites served malware. - **Phishing Campaigns:** During a three-month tracking study (March 1 to June 1), researchers monitored direct-message phishing links featuring conversational hooks (e.g., "I'm laughing so hard right now at this"). Victims landing on fake timeout pages entered credentials, losing up to 30,000 accounts per day. Traditional defenses like sandboxes and honeypots struggled because campaigns relied on user-to-user links and nested shortened URL redirection chains. - **Follower Scam Mechanics:** Follower scams operated via free or paid tiers (via PayPal or regional banks such as Bank of Central Asia). In free tiers, users authorized malicious Twitter applications via the Twitter API. This enrolled the account into a botnet-like circle of compromised accounts that automatically posted malicious tweets, sent direct messages, and followed or retweeted others. Active regional variants included Indonesian language scams (heavily utilizing .ga and .tk TLDs, averaging 125 tweets/day) and multi-platform commercial selling scams (averaging 22,000 tweets/day).

### Takeaways Twitter mitigated substantial abuse via measures such as its BotMaker initiative and inserting spam detection directly into the write-path (yielding a rapid ~40% reduction in spam). Remediating follower scams requires users to review app settings and revoke unauthorized application permissions. Ultimately, because social media provides high click-through rates and high account value while evading honeypots and sandboxes, defenders must incorporate big data, graphical algorithms, and machine learning into their detection stacks.