We uncover a thriving ecosystem of large-scale reputation manipulation services on Facebook that leverage the principle of collusion. Collusion networks collect OAuth access tokens from colluding members and abuse them to provide fake likes or comments to their members. We carry out a comprehensive measurement study to understand how these collusion networks exploit popular third-party Facebook applications with weak security settings to retrieve OAuth access tokens. We infiltrate popular collusion networks using honeypots and identify more than one million colluding Facebook accounts by "milking" these collusion networks. We disclose our findings to Facebook and collaborate with them to implement a series of countermeasures that mitigate OAuth access token abuse without sacrificing application platform usability for third-party developers. These countermeasures remained in place until April 2017, after which Facebook implemented a set of unrelated changes in its infrastructure to counter collusion networks. We are the first to report and effectively mitigate large-scale OAuth access token abuse in the wild.

We investigate the evolution of search-engine poisoning using data on over 5 million search results collected over nearly 4 years. We build on prior work investigating search-redirection attacks, where criminals compromise high-ranking websites and direct search traffic to the websites of paying customers, such as unlicensed pharmacies who lack access to traditional search-based advertisements. We overcome several obstacles to longitudinal studies by amalgamating different resources and adapting our measurement infrastructure to changes brought by adaptations by both legitimate operators and attackers. Our goal is to empirically characterize how strategies for carrying out and combating search poisoning have evolved over a relatively long time period. We investigate how the composition of search results themselves has changed. For instance, we find that search-redirection attacks have steadily grown to take over a larger share of results (rising from around 30% in late 2010 to a peak of nearly 60% in late 2012), despite efforts by search engines and browsers to combat their effectiveness. We also study the efforts of hosts to remedy search-redirection attacks. We find that the median time to clean up source infections has fallen from around 30 days in 2010 to around 15 days by late 2013, yet the number of distinct infections has increased considerably over the same period. Finally, we show that the concentration of traffic to the most successful brokers has persisted over time. Further, these brokers have been mostly hosted on a few autonomous systems, which indicates a possible intervention strategy.

Electronic commerce has transformed how goods are supplied to consumers, but has also exposed weaknesses in supply regulations of certain goods, such as alcohol, weapons or prescription drugs. While licensed pharmacies have tread carefully with online sales, many enterprising operators have been selling pharmaceuticals without a license for years. Despite facing considerable adversity, unlicensed online pharmacies have managed not only to survive, but even to generate considerable revenue. In this paper, we attempt 1) to understand the economic reasons for their success, while facing stiff competition from both legal and illegal alternatives, and 2) to identify characteristics of their supply chains that could be used to disrupt illicit sales. We collected six months' worth of inventory and pricing data from 265 online pharmacies that advertise through search- engine poisoning. We compare this to data from Silk Road, an anonymous online marketplace, and from familymeds.com, a licensed online pharmacy. We discover that instead of directly competing with licensed pharmacies, unlicensed pharmacies often sell drugs that licensed pharmacies do not or cannot sell. Furthermore, unlicensed pharmacies are not only cheaper overall, but they also offer volume discounts. Clustering analysis of inventories reveals that only a few suppliers appear to cater for most unlicensed pharmacies, which suggests that cutting them off could disrupt unlicensed sales. Cross-validating our data with inventories from a random sample of 265 different pharmacies deemed ``not recommended'' by the National Association of Boards of Pharmacy shows that our results are consistent across different types of questionable vendors.

Online service providers are engaged in constant conflict with miscreants who try to siphon a portion of legitimate traffic to make illicit profits. We study the abuse of "trending" search terms, in which miscreants place links to malware-distributing or ad-filled web sites in web search and Twitter results, by collecting and analyzing measurements over nine months from multiple sources. We devise heuristics to identify ad-filled sites, report on the prevalence of malware and ad-filled sites in trending-term search results, and measure the success in blocking such content. We uncover collusion across offending domains using network analysis, and use regression analysis to conclude that both malware and ad-filled sites thrive on less popular, and less profitable trending terms. We build an economic model informed by our measurements and conclude that ad-filled sites and malware distribution may be economic substitutes. Finally, because our measurement interval spans February 2011, when Google announced changes to its ranking algorithm to root out low-quality sites, we can assess the impact of search-engine intervention on the profits miscreants can achieve.

Automatic identification (auto-ID) procedures exist to provide information about people, animals, goods and products in transit. The RFID technology is one of the newest and mostly emerging implementations of the auto-ID concept. Most of the current applications of the RFID technology pair the unique ID (UID) stored in RFID tags attached to an item with information about it, which is located in information systems. When the item gets transferred or modified, new information might need to be paired with its UID as well. The EPCglobal has defined standards that facilitate the collection, storage, update, location and sharing of the information related to the UID. In this paper, we explain the disadvantages of the EPC glocal approach and discuss an infrastructure with an associated service built on top, which is intended to organize the information associated with any object, and guide the process of discovering and retrieving specific information for specific items, tagged with a unique id, in an efficient and scalable way. Then we will describe the overall architecture and the proposed service, called service lookup service (SLS) and we will provide a proposed protocol for implementing the aforementioned service.