## 2 Mobile Social Networking
### Attacks and Defenses in CAMSN services  
In all types of mobile social networks, issues of security and privacy exist. Attacks on mobile social networking services (both contextual and traditional) include Sybil attacks, wormhole attacks, anonymity attacks, as well as social-engineering based phishing attacks. Furthermore, information leak and privacy issues are possible. Many of these problems can exist in a mobile social network without regard to the level of contextual awareness introduced by it. Below, we describe some of these problems in further detail and, where possible, provide mitigation strategies for them. In a **Sybil attack**, a single entity takes on the roles of multiple entities (known as _Sybil identities_) for illicit purposes. The Sybil attack is possible in any service that utilizes reputation information assigned by service clients (e.g. peers of a device on a service), and is in many ways similar to the real-world concept of ballot stuffing [17, 18, 19]. Sybil attacks are possible in CAMSN. For example, an attacker can hijack a social networking site's highest ranked profiles list by creating many bogus accounts (or taking control of many legitimate accounts) and using those accounts to vote for a target profile. The bogus or stolen accounts need not cast their votes at the same time. As another example, an attacker using a CAMSN service can illicitly advertise a physical location (e.g. a bar or pub) by converging a number of bogus (or stolen) identities upon that location; the location will thereby appear popular to legitimate users of the CAMSN. In this case, the bogus or stolen accounts must converge on that physical location at the same time in order to make it appear popular. Service designers and engineers can prevent a Sybil attack altogether only via careful certification of identities by a trusted authority [17], which must ensure every entity has only one identity. [PERSON] _et al._ designed a novel solution based on location-based cryptographic keys to prevent Sybil attacks, in particular, location-spoofing based Sybil attacks in wireless sensor networks [20]. The proposed location-based keys are generated using pairing-based identity-based cryptography by a trusted authority. Similarly, Trusted Computing Group (TCG) modules could allow for the attestation of code running on a MSN device [21], thereby helping to prevent the hijacking of legitimate identities. Power consumption of an on-board TCG module is an issue in the latter of these solutions, while the requirement of a trusted, external authority is unreasonable in the former (especially in the case of peer-to-peer systems). Methods of attesting memory contents in wireless sensor networks have been proposed [22, 23]; these methods could potentially be applied to mobile social networks and the hardware thereof. Steps a service's designers can take to limit a Sybil attack's effectiveness include limiting the privileges (or relative weight) of newly created identities and making the creation of new identities difficult. The latter can be accomplished, for example, by requiring that a CAPTCHA be solved [24]. Verifying the physical locations of identities to ensure that they move in a realistic manner has been proposed [19]. For example, the position of Sybil identities might be expected to shift locations rapidly. In the realm of CAMSN services, such location based methodologies for detecting Sybil attacks are of particular use when location information is already known - the cost of implementing them might be comparatively low (see this paper's discussion of Secure Location Verification in section 5). Lastly, a method of examining the connectivity characteristics of social graphs to prevent Sybil attacks has been proposed [25]. An overview of further solutions to the Sybil attack is found in [18]. **Attacks against anonymity**: CAMSN services are susceptible to attacks which leverage the fact that a user's identity is often intrinsically associated with a social networking profile and location information [26].