LUMS Faculty Discovers Major Facebook Security Flaw

Tuesday, September 12, 2017

Facebook is the world’s number one social network. With an active user base of over 1.8 billion, if the social media giant was a country, it would be much bigger than China. So it is no surprise that it remains the most popular social network for content creators and marketers.

A recent study conducted by Dr. Muhammad Fareed Zaffar, Assistant Professor, Computer Sciences, at Syed Babar Ali School of Science and Engineering (SBASSE), Lahore University of Management Sciences (LUMS), Shehroze Farooqi and Zubair Shafiq from University of Iowa, have exposed dozens of ‘collusion networks’ involved in fraudulent reputation manipulation activities on Facebook.

In these networks, members collude to mutually like each other’s posts. Such collusion networks of significant size enable members to receive a large number of likes from other members, making them appear much more popular than they actually are.  The team’s research paper entitled, 'Measuring and Mitigating OAuth Access Token Abuse by Collusion Networks', is set to be published at the 17th Internet Measurement Conference (IMC) in London.

According to Dr. Zaffar, the research has the potential to undermine the credibility of information disseminated through digital platforms such as Facebook and Twitter. The researchers expose large-scale OAuth access token abuse that generated at least a 100 million “likes” and comments as part of “a thriving ecosystem of reputation manipulation.” The research also identifies a large number of popular third-party Facebook applications with security flaws that can be exploited to steal personal information and launch malware attacks.

The initial work on the project was done independent of Facebook. The teams at LUMS and Iowa conducted a thorough technical analysis of the vulnerability of the platform, and were able to measure and characterize collusion networks through passive and active experiments. The counter-measures to stop this reputation fraud however required a significant collaboration with the teams at Facebook. Facebook’s Research and Academic Relations Program has also made an unrestricted gift to support Dr. Zaffar's work.