khirad
BANNED
- Nov 10, 2009
- 642
- 184
After the Failure of Orkut Google is Back With Google Buzz And they have very high Expectations With this
A user with a Buzz account, means that they have a Gmail account, and the name visible in Buzz is often used in some form or another as the user's Gmail account. As a spammer, one could create a network of Gmail accounts connected to Buzz and follow a large number of users, follow their followers, etc. Harvest user names / alias names for those being followed, and do best guess attempts at guessing their email address and start sending test messages. Once a successful guess has occurred, the email address will then be exposed in the Buzz interface validating that the email address exists and is tied to that user.
The way this would likely work and scale for the spammer is through the creation of an automated Google Buzz bot or worm to build a list of followers and spider out to the followers of followers and so forth in order to harvest Gmail names / aliases to guess against and build an email spam list. The email validation not only validates that the email account is live, but validates that it is linked to the social network visible in Buzz. In other words, knowledge of that particular user's social network could also be used in an automated but more targeted spam campaign. For example, email subject "Hey I see you are friends with XYZ..." email body: "Here are some pictures of her that I thought you would get a kick out of: insert link/attachment"
Additionally, once a user is connected / followed in Buzz you can interact in other mediums besides email. This could be leveraged to bypass spam filters within Gmail. Gchat, Google Wave, Blogger, Google Reader, etc. are some examples of interactive mediums that Buzz provides its users.
A user with a Buzz account, means that they have a Gmail account, and the name visible in Buzz is often used in some form or another as the user's Gmail account. As a spammer, one could create a network of Gmail accounts connected to Buzz and follow a large number of users, follow their followers, etc. Harvest user names / alias names for those being followed, and do best guess attempts at guessing their email address and start sending test messages. Once a successful guess has occurred, the email address will then be exposed in the Buzz interface validating that the email address exists and is tied to that user.
The way this would likely work and scale for the spammer is through the creation of an automated Google Buzz bot or worm to build a list of followers and spider out to the followers of followers and so forth in order to harvest Gmail names / aliases to guess against and build an email spam list. The email validation not only validates that the email account is live, but validates that it is linked to the social network visible in Buzz. In other words, knowledge of that particular user's social network could also be used in an automated but more targeted spam campaign. For example, email subject "Hey I see you are friends with XYZ..." email body: "Here are some pictures of her that I thought you would get a kick out of: insert link/attachment"
Additionally, once a user is connected / followed in Buzz you can interact in other mediums besides email. This could be leveraged to bypass spam filters within Gmail. Gchat, Google Wave, Blogger, Google Reader, etc. are some examples of interactive mediums that Buzz provides its users.
Last edited:
