Catch Me (On Time) If You Can: Understanding the Effectiveness of Twitter URL Blacklists
This research addresses security threats for Twitter users by evaluating blacklist delays, but it is incremental as it builds on existing blacklist analysis methods.
The study assessed the effectiveness of Twitter's URL blacklists in protecting users from phishing and malware attacks by analyzing over 182 million tweets and comparing URLs against blacklists like Google Safe Browsing. Results showed that while many malicious URLs are blocked within 6 hours, significant numbers remain undetected for at least 20 days, with 4,930 tweets containing social engineering URLs reaching over 131 million users and 1,126 tweets with blacklisted Bitly URLs receiving 991,012 clicks.
With more than 500 million daily tweets from over 330 million active users, Twitter constantly attracts malicious users aiming to carry out phishing and malware-related attacks against its user base. It therefore becomes of paramount importance to assess the effectiveness of Twitter's use of blacklists in protecting its users from such threats. We collected more than 182 million public tweets containing URLs from Twitter's Stream API over a 2-month period and compared these URLs against 3 popular phishing, social engineering, and malware blacklists, including Google Safe Browsing (GSB). We focus on the delay period between an attack URL first being tweeted to appearing on a blacklist, as this is the timeframe in which blacklists do not warn users, leaving them vulnerable. Experiments show that, whilst GSB is effective at blocking a number of social engineering and malicious URLs within 6 hours of being tweeted, a significant number of URLs go undetected for at least 20 days. For instance, during one month, we discovered 4,930 tweets containing URLs leading to social engineering websites that had been tweeted to over 131 million Twitter users. We also discovered 1,126 tweets containing 376 blacklisted Bitly URLs that had a combined total of 991,012 clicks, posing serious security and privacy threats. In addition, an equally large number of URLs contained within public tweets remain in GSB for at least 150 days, raising questions about potential false positives in the blacklist. We also provide evidence to suggest that Twitter may no longer be using GSB to protect its users.