Adversaries have been targeting unique identifiers to launch typo-squatting, mobile app squatting and even voice squatting attacks. Anecdotal evidence suggest that online social networks (OSNs) are also plagued with accounts that use similar usernames. This can be confusing to users but can also be exploited by adversaries. However, to date no study characterizes this problem on OSNs. In this work, we define the username squatting problem and design the first multi-faceted measurement study to characterize it on X. We develop a username generation tool (UsernameCrazy) to help us analyze hundreds of thousands of username variants derived from celebrity accounts. Our study reveals that thousands of squatted usernames have been suspended by X, while tens of thousands that still exist on the network are likely bots. Out of these, a large number share similar profile pictures and profile names to the original account signalling impersonation attempts. We found that squatted accounts are being mentioned by mistake in tweets hundreds of thousands of times and are even being prioritized in searches by the network's search recommendation algorithm exacerbating the negative impact squatted accounts can have in OSNs. We use our insights and take the first step to address this issue by designing a framework (SQUAD) that combines UsernameCrazy with a new classifier to efficiently detect suspicious squatted accounts. Our evaluation of SQUAD's prototype implementation shows that it can achieve 94% F1-score when trained on a small dataset.

翻译：攻击者一直针对唯一标识符发起域名抢注、移动应用抢注甚至语音抢注攻击。轶事证据表明，在线社交网络同样充斥着使用相似用户名的账户。这不仅会令用户产生混淆，还可能被攻击者利用。然而，迄今尚无研究系统性地描述在线社交网络中的这一问题。本研究首次定义了“用户名抢注问题”，并设计了首个多维度测量研究，以X平台为对象刻画其特征。我们开发了用户名生成工具UsernameCrazy，帮助分析从名人账户衍生的数十万个用户名变体。研究揭示，数千个抢注用户名已被X平台暂停，而网络中仍存在的数万个此类账户很可能是僵尸账号。其中，大量账户的档案图片和名称与原始账户高度相似，暗示存在冒充行为。我们发现，抢注账户在推文中被误提及数十万次，甚至被平台的搜索推荐算法优先展示，加剧了其在社交网络中的负面影响。基于这些发现，我们迈出解决该问题的第一步——设计了一个框架SQUAD，将UsernameCrazy与新型分类器结合，高效检测可疑的抢注账户。对SQUAD原型系统的评估表明，其在小型数据集上训练后仍能达到94%的F1分数。