In contrast to the rising supremacy of hyperscaler artificial intelligence, it becomes a particularly interesting question what attackers with limited computational resources are capable of by utilizing machine learning on a smaller scale. A very inconspicuous but yet powerful vulnerability to leverage for profiling is user enumeration, i.e., knowing if a user is registered on an application. Its risk is often intentionally accepted in favor of usability. It can typically be exploited via public components such as login forms, which are accessible without special restrictions. In this paper, we present a novel approach for profiling not documented in literature. By training models on a small dataset based on user enumeration data from 396 test subjects and 111 web applications we are able to predict individual attributes about an unknown person behind an arbitrary e-mail address. For this, we developed AccountGrabber, a dedicated user enumeration tool and a mean-based prediction algorithm, which can generate fuzzy output values reflecting possible nuances of human perception. To support the feasibility of our idea, we compare its performance to 9 classical classification algorithms and conclude with suggestions for future improvements to more complex profiling.

错误:搜索内容不能为空,请输入英文关键词
错误:关键词超出字数限制,请精简
高级检索

Towards Intelligent User Enumeration Based Profiling

  • Mario Bischof,
  • Edy Portmann

摘要

In contrast to the rising supremacy of hyperscaler artificial intelligence, it becomes a particularly interesting question what attackers with limited computational resources are capable of by utilizing machine learning on a smaller scale. A very inconspicuous but yet powerful vulnerability to leverage for profiling is user enumeration, i.e., knowing if a user is registered on an application. Its risk is often intentionally accepted in favor of usability. It can typically be exploited via public components such as login forms, which are accessible without special restrictions. In this paper, we present a novel approach for profiling not documented in literature. By training models on a small dataset based on user enumeration data from 396 test subjects and 111 web applications we are able to predict individual attributes about an unknown person behind an arbitrary e-mail address. For this, we developed AccountGrabber, a dedicated user enumeration tool and a mean-based prediction algorithm, which can generate fuzzy output values reflecting possible nuances of human perception. To support the feasibility of our idea, we compare its performance to 9 classical classification algorithms and conclude with suggestions for future improvements to more complex profiling.