What Happens After You Are Pwnd: Understanding the Use of Leaked Webmail Credentials in the Wild
Abstract
Cybercriminals steal access credentials to webmail accounts and then misuse them for their own profit, release them publicly, or sell them on the underground market. Despite the importance of this problem, the research community still lacks a comprehensive understanding of what these stolen accounts are used for. In this paper, we aim to shed light on the modus operandi of miscreants accessing stolen Gmail accounts. We developed an infrastructure that is able to monitor the activity performed by users on Gmail accounts, and leaked credentials to 100 accounts under our control through various means, such as having information-stealing malware capture them, leaking them on public paste sites, and posting them on underground forums. We then monitored the activity recorded on these accounts over a period of 7 months. Our observations allowed us to devise a taxonomy of malicious activity performed on stolen Gmail accounts, to identify differences in the behavior of cybercriminals that get access to stolen accounts through different means, and to identify systematic attempts to evade the protection systems in place at Gmail and blend in with the legitimate user activity. This paper gives the research community a better understanding of a so far understudied, yet critical aspect of the cybercrime economy.
Integrity signals
Registry
Cites
Statistics
Claims the paper makes
Claims other papers make about this one
Each is checked against this paper’s own text: does it say what the citing paper says it does?
The paper found rapid review bursts in both qualitative and quantitative investigations, consistent with assumptions in prior fraud-detection work, and interview participants revealed adaptive rate control as an avoidance technique.
“We found ASO workers who post fake reviews in rapid bursts in both our qualitative and quantitative investigations.This is consistent with assumptions made in previous fraud detection work, e.g., [26, 28, 32, 36-38, 40, 42, 43, 51, 52, 59-61, 63, 65, 92, 95, 96, 100].”
From The Art and Craft of Fraudulent App Promotion in Google Play (2019) · cites this paper as [40]
Cites
Asymptotic Theory of Certain "Goodness of Fit" Criteria Based on Stochastic Processes
Anderson, T. W., & Darling, D. A. (1952) · The Annals of Mathematical Statistics · doi:10.1214/aoms/1177729437 · Cited by 3,542 · see citing works
(2011) · IEEE Software · doi:10.1109/ms.2011.67 · Cited by 2,038 · see citing works
Dhamija, R., Tygar, J. D., & Hearst, M. (2006) · Proceedings of the SIGCHI Conference on Human Factors in Computing Systems · doi:10.1145/1124772.1124861 · Cited by 1,376 · see citing works
Jagatic, T. N., Johnson, N. A., Jakobsson, M., & Menczer, F. (2007) · Communications of the ACM · doi:10.1145/1290958.1290968 · Cited by 1,156 · see citing works
The Annals of Mathematical Statistics
King, W. I. (1930) · The Annals of Mathematical Statistics · doi:10.1214/aoms/1177733256 · Cited by 832 · see citing works
Detecting spammers on social networks
Stringhini, G., Kruegel, C., & Vigna, G. (2010) · Proceedings of the 26th Annual Computer Security Applications Conference · doi:10.1145/1920261.1920263 · Cited by 791 · see citing works
Self-citationMagno, G., Rodrigues, T., & Almeida, V. A. F. (2010) · Cited by 649 · see citing works
On the composition of elementary errors
Cramér, H. (1928) · Scandinavian Actuarial Journal · doi:10.1080/03461238.1928.10416862 · Cited by 626 · see citing works
Stone-Gross, B., Cova, M., Cavallaro, L., Gilbert, B., Szydlowski, M., Kemmerer, R. A., Kruegel, C., & Vigna, G. (2009) · ACM SIGSAC Conference on Computer and Communications Security (CCS) · doi:10.1145/1653662.1653738 · Cited by 577 · see citing works
Klimt, B., & Yang, Y. (2004) · Conference on Email and Anti-Spam · Cited by 538 · see citing works
The Tangled Web of Password Reuse
Das, A., Bonneau, J., Caesar, M., Borisov, N., & Wang, X. (2014) · Network and Distributed System Security Symposium · doi:10.14722/ndss.2014.23357 · Cited by 446 · see citing works
Boshmaf, Y., Muslukhov, I., Beznosov, K., & Ripeanu, M. (2011) · Annual Computer Security Applications Conference · doi:10.1145/2076732.2076746 · Cited by 439 · see citing works
Suspended accounts in retrospect: an analysis of twitter spam
Thomas, K., Grier, C., Song, D., & Paxson, V. (2011) · Proceedings of the 2011 ACM SIGCOMM conference on Internet measurement conference · doi:10.1145/2068816.2068840 · Cited by 439 · see citing works
Cookieless Monster: Exploring the Ecosystem of Web-Based Device Fingerprinting
Nikiforakis, N., Kapravelos, A., Joosen, W., et al. (2013) · Proceedings - IEEE Symposium on Security and Privacy/Proceedings of the ... IEEE Symposium on Security and Privacy · doi:10.1109/sp.2013.43 · Cited by 428 · see citing works
Targeted Online Password Guessing
Wang, D., Zhang, Z., Wang, P., Yan, J., & Huang, X. (2016) · ACM SIGSAC Conference on Computer and Communications Security (CCS) · doi:10.1145/2976749.2978339 · Cited by 352 · see citing works
You are how you click: Clickstream analysis for Sybil detection
Wang, G., Konolige, T., Wilson, C., Wang, X., Zheng, H.-T., & Zhao, B. Y. (2013) · Cited by 256 · see citing works
COMPA: Detecting Compromised Accounts on Social Networks.
Egele, M., Stringhini, G., Krügel, C., & Vigna, G. (2013) · Cited by 250 · see citing works
Self-citationTrafficking fraudulent accounts: the role of the underground market in Twitter spam and abuse
Thomas, K., McCoy, D., Grier, C., Kolcz, A., & Paxson, V. (2013) · Cited by 239 · see citing works
Prudent Practices for Designing Malware Experiments: Status Quo and Outlook
Rossow, C., Dietrich, C., Grier, C., Kreibich, C., Paxson, V., Pohlmann, N., Bos, H., & van Steen, M. R. (2012) · IEEE Symposium on Security and Privacy (S&P) · doi:10.1109/sp.2012.14 · Cited by 238 · see citing works
On the analysis of the Zeus botnet crimeware toolkit
Binsalleeh, H., Ormerod, T. C., Boukhtouta, A., et al. (2010) · International Conference on Privacy, Security and Trust (PST) · doi:10.1109/pst.2010.5593240 · Cited by 202 · see citing works
Studying spamming botnets using Botlab
John, J. P., Moshchuk, A., Gribble, S. D., & Krishnamurthy, A. (2009) · Cited by 185 · see citing works
Stone-Gross, B., Holz, T., Stringhini, G., & Vigna, G. (2011) · Cited by 152 · see citing works
Self-citationSocial Honeypots: Making Friends With A Spammer Near You.
Webb, S., Caverlee, J., & Pu, C. (2008) · Cited by 110 · see citing works
The social honeypot project: protecting online communities from spammers
Lee, K., Caverlee, J., & Webb, S. (2010) · Proceedings of the 19th international conference on World wide web · doi:10.1145/1772690.1772843 · Cited by 106 · see citing works
Doppelgänger Finder: Taking Stylometry to the Underground
Afroz, S., Islam, A. C., Stolerman, A., Greenstadt, R., & McCoy, D. (2014) · IEEE Symposium on Security and Privacy (S&P) · doi:10.1109/sp.2014.21 · Cited by 101 · see citing works
Handcrafted Fraud and Extortion
Bursztein, E., Benkő, B. K., Margolis, D., et al. (2014) · doi:10.1145/2663716.2663749 · Cited by 74 · see citing works
Sender Reputation in a Large Webmail Service.
Taylor, B. J. (2006) · Conference on Email and Anti-Spam · Cited by 73 · see citing works
That Ain’t You: Blocking Spearphishing Through Behavioral Modelling
Stringhini, G., & Thonnard, O. (2015) · Lecture notes in computer science · doi:10.1007/978-3-319-20550-2_5 · Cited by 56 · see citing works
Self-citationExposing the lack of privacy in file hosting services
Nikiforakis, N., Balduzzi, M., Acker, S. V., et al. (2011) · Lirias · Cited by 24 · see citing works
Honey Sheets: What Happens to Leaked Google Spreadsheets?Preprint
Lazarov, M., Onaolapo, J. O., & Stringhini, G. (2016) · arXiv (Cornell University) · doi:10.48550/arxiv.1607.00801 · Cited by 17 · see citing works
Self-citationHow many eyes are spying on your shared folders?
Liu, B., Liu, Z., Zhang, J., et al. (2012) · ACM Workshop on Privacy in the Electronic Society (WPES) · doi:10.1145/2381966.2381982 · Cited by 11 · see citing works
Towards Detecting Compromised Accounts on Social NetworksPreprint
Egele, M., Stringhini, G., Kruegel, C., et al. (2015) · arXiv (Cornell University) · doi:10.48550/arxiv.1509.03531 · Cited by 5 · see citing works
Self-citation
Flagged first, then by citations
Cited by
Sorted by citations
The Art and Craft of Fraudulent App Promotion in Google Play
Rahman, M., Hernandez, N., Recabarren, R., Ahmed, S. I., & Carbunar, B. (2019) · Proceedings of the 2019 ACM SIGSAC Conference on Computer and Communications Security · doi:10.1145/3319535.3345658 · Cited by 24 · see citing works
- Authors
- Onaolapo, J., Mariconti, E., & Stringhini, G.
- Affiliations
- University College London (GB)
- Venue
- Proceedings of the 2016 Internet Measurement Conference
- Publisher
- ACM
- Published
- 2016-11-14
- Pages
- 65-79
- OpenAlex
- W2550183133
- Cited by
- 74
- References
- 32
- Citations by year
- 2026: 1 · 2025: 6 · 2024: 9 · 2023: 7 · 2022: 3 · 2021: 4 · 2020: 12 · 2019: 19 · 2018: 8 · 2017: 4 · 2016: 1
- FWCI
- 9.06
- Type
- conference paper
- Language
- en
- Open access
- closed
- Locations
- ACM Internet Measurement Conference (IMC) (publishedVersion)
- Funders
- Engineering and Physical Sciences Research Council (EP/N008448/1,1490017)
- Topics
- Physical Sciences › Computer Science › Information Systems › Cybercrime and Law Enforcement Studies
- Physical Sciences › Computer Science › Information Systems › Spam and Phishing Detection
- Physical Sciences › Computer Science › Information Systems › User Authentication and Security Systems
- Keywords
- Gmail, cybercrime, modus operandi, underground forums, credential leakage
About these checks
Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.
Statistics and arithmetic are recomputed, not judged.
Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.
What counts as a claim ›How we measure confidence ›How we check this ›
Are you an author, or do you see a problem with this page? Request a review
