Anti-social networking
The more we tell the world, the easier it is for crooks to use information in ways we never intended.
Published: 8/06/2011 at 12:00 AM
Newspaper section: Business
Have you ever received an intriguing message posted on your Facebook wall - presumably from one of your friends - asking you to click the link provided? Or an advertising testimonial on Twitter from your favourite football player?
Perhaps you have found a fake Facebook account with your name and profile picture. That happened to a Thai university professor shortly after the Japanese earthquake and visitors were tricked into believing that she was raising money for disaster relief.
Everyone these days enjoys using social networks, but the more we tell our friends - and the world - the more vulnerable we become to cybercrooks and scam artists. And now that businesses are increasingly using the likes of Facebook and Twitter for marketing, they too are becoming highly vulnerable to having their entire online presence compromised.
Identity theft is becoming a major danger for social network users, according to Kaspersky Lab, a Russian-based IT security and threat management company. For one thing, people don't always know their online friends in real life, and social networks do not usually verify the identities of users creating accounts.
Security experts say that "identity hijacking" involves a profile being created using the victim's real name, and then that person's real friends are infiltrated. The identity thieves cultivate their contacts and then threaten victims with the publication of embarrassing pictures or compromising comments. The only thing that will save their victims' virtual reputations is money.
A general user's information and picture offer a cybercriminal an easy point of entry to steal an identity and create a fake account, says Nakrop Niamnamtham, managing director of nForce Security Systems AP, an information security solution distributor.
"Social networks are a double-edged sword. In my own experience, I received negative reactions from my friends and later found that those friends had formed a bad impression based on messages and activities on my fake Facebook account," Mr Nakrop recalled.
In some cases criminals use the real name and photo of an attractive woman to create a fake account and lure men to transfer money. The real person has no idea what's going on.
Social networks are also becoming key distribution points for malware or malicious software, the recent Koobface worm that affected Facebook being a prime example, according to Kaspersky Lab.
This secretive worm sent several waves of private messages to Facebook users, announcing that new photos featuring them had been published online. Clicking on the link in the message infected the user's PC, enabling it to be controlled remotely by hackers.
The PC then becomes part of what's known as a botnet, a network of computers that is used to attack other networks or for sending spam. Koobface distributes itself via existing user accounts and their friend lists on social networks.
It does so by sending comments and messages that contain, for example, links to fake YouTube pages, inviting users to download the current version of Flash Player to view the video. Instead of adding video or Flash to their systems, however, the worm infects them.
Nopchai Tangthritham, a technical director of Symantec, the US-based security software vendor, says that the inherent trust we place in social networks, especially of messages coming from friends, makes it easy for attacks to succeed.
He said his company also found that hackers were using shortened web links to hide malware, especially on Twitter.
Mr Nakrob noted that most social networks allow a user to set different privacy settings for confirmed friends in contrast to public strangers. Facebook distinguishes three groups of visitors - direct friends, friends of friends, or everyone - which helps classify the level of information and photos to share with others.
But how many users are aware of and know how to adjust their privacy settings? Despite repeated warnings and heavy media coverage, most people never touch their Facebook settings after initially making a few clicks on the day they set up their accounts.
Third-party applications such as games and horoscopes will ask users' permission to access their detailed information, so before using any third-party app via a social network, one needs to check its authenticity.
"Even for such a little piece of information such as a birthday that you share on your social networking site, a bad guy can use this basic information for an answer to a security question to verify your credit card identity," Mr Nakrob said.
Because so many people now use social network sites at work, threats to corporate IT networks are growing.
While some companies have IT policies that explicitly regulate the use of sites such as Facebook or Twitter, few block employee access to social networking sites because some departments have legitimate needs to use those sites for marketing, sales and customer service.
Mr Nakrob suggested that all companies should set security policies for social networks. For instance, if an employee posts photos or information related to customers on a personal Facebook account, that information could be leaked to rivals or have even worse consequences.
Meanwhile, existing security firewalls are not keeping up with new types of applications, particularly those related to social networks, YouTube or Skype. This is leading to increased demand for next-generation firewalls to use in organisational security.
Some security vendors, including Palo Alto Networks Thailand, are providing next-generation firewalls that allow businesses to set controls on the use of social networking or limit it to authorised employees. For instance, they may allow viewing and replying but not posting video or documents on a wall. This could prevent the posting of inappropriate content that violates the law or risks leaks of trade secrets.
-----
SOCIAL MEDIA ATTACKS
FACEBOOK
Likejacking Cybercriminals create intriguing posts that exploit interest in seasonal events, celebrity news and even disasters.
Users who click the links inadvertently act as accomplices to the attacker because the malicious scripts automatically repost the links, images or videos on their contacts' walls. Popular version of this attack causes user profiles to "Like" a Facebook page without their consent
Rogue applications Cybercriminals use Facebook's open platform to applications for spam posts or phishing attacks
Attacks via chat Facebook's built-in chat feature makes cybercriminals spread malware and to promote phishing applications
TWITTER
Spammed Tweets Cybercriminals create compelling posts with links. Examples include promotions for free vouchers, job advertisements or testimonials for weight-loss products
Malware downloads Most popular tactic is the use of video-related posts, which lead create users to a fake YouTube page where they could download a malicious file
Twitter bots Use of Twitter to manage and control botnet zombies
MY THOUGHTS
This is getting scarier and scarier.
Showing posts with label facebook security. Show all posts
Showing posts with label facebook security. Show all posts
Tuesday, June 7, 2011
Saturday, May 14, 2011
HOW NOT TO GET HACKED ON FACEBOOK
HOW NOT TO GET HACKED ON FACEBOOK
from the article 'Facebook Users: How Not to Get Hacked'
By Kimberly Weisul | May 10, 2011
There are plenty of things Facebook users, and others, can do to protect their personal information online. Consumer Reports recommends:
Keep tabs on your kids’ accounts. Some kids won’t ‘friend’ their parents, of course, but they just might fork over their user name and password. Other parents can keep up on their children’s online activities via siblings or other friends.
Use privacy controls. Consumer Reports found that one in five adult Facebook users don’t use privacy controls. Whenever Facebook gives you a choice, set the information to be visible only to your friends. Otherwise your profile picture, friends list, activities, and other info can be seen by anyone who does a public search on your name.
Turn off Instant Personalization. Instant personalization shares your location information with sites such as Yelp and TripAdvisor (and the list is growing). The default setting for “instant personalization” is “on,” but you can turn it off.
Be careful with apps. In most cases, you can decide which information an app can see. Facebook says it doesn’t share identifiable information with advertisers, but using an app does make general information available.
Set a PIN number for your phone. Most smartphones allow you to set a four-digit PIN for your phone, but only about 20 percent of people-even those who store sensitive information on their phones-actually do this.
Protect your phone. The PIN is just the start. Many manufacturers offer over-the-air backup, remote phone locating, remote phone locking, and erasing of data and account info. You can also get software to lock your phone or erase data remotely. Turn off the phone’s GPS feature if you don’t need it.
MY THOUGHTS
I never liked the apps.
from the article 'Facebook Users: How Not to Get Hacked'
By Kimberly Weisul | May 10, 2011
There are plenty of things Facebook users, and others, can do to protect their personal information online. Consumer Reports recommends:
Keep tabs on your kids’ accounts. Some kids won’t ‘friend’ their parents, of course, but they just might fork over their user name and password. Other parents can keep up on their children’s online activities via siblings or other friends.
Use privacy controls. Consumer Reports found that one in five adult Facebook users don’t use privacy controls. Whenever Facebook gives you a choice, set the information to be visible only to your friends. Otherwise your profile picture, friends list, activities, and other info can be seen by anyone who does a public search on your name.
Turn off Instant Personalization. Instant personalization shares your location information with sites such as Yelp and TripAdvisor (and the list is growing). The default setting for “instant personalization” is “on,” but you can turn it off.
Be careful with apps. In most cases, you can decide which information an app can see. Facebook says it doesn’t share identifiable information with advertisers, but using an app does make general information available.
Set a PIN number for your phone. Most smartphones allow you to set a four-digit PIN for your phone, but only about 20 percent of people-even those who store sensitive information on their phones-actually do this.
Protect your phone. The PIN is just the start. Many manufacturers offer over-the-air backup, remote phone locating, remote phone locking, and erasing of data and account info. You can also get software to lock your phone or erase data remotely. Turn off the phone’s GPS feature if you don’t need it.
MY THOUGHTS
I never liked the apps.
Monday, February 7, 2011
HOW SECURED IS FACEBOOK
Facebook defends security strategy
Shy social network responds to criticism
By John Leyden • Get more from this author
Posted in Malware, 21st January 2011 16:01 GMT
Analysis Facebook has defended its record in thwarting rogue applications and other security in the face of criticism from security firms that it ought to adopt tighter application controls.
The dominant social network disputes findings from a threat report by UK-based net security firm Sophos, released earlier this week, that spam, malware and other attacks have become more effective against Facebook users over the last year.
Facebook reckons the opposite is true while disputing the methodology adopted by Sophos which it said looked, for example, at the volume of spam sent to Facebook users instead of the volume that reached their in-boxes.
Facebook said: "If your spam filter catches all the spam, does it matter that your filter caught 10 per cent more?"
The social networking site reckons less than three per cent of communications on Facebook are spam, compared to industry estimates that email spam makes up 90 per cent of all electronic messages. The implication is that Sophos is focusing on the wrong problem.
Unfriending rogues
Survey scams have become an almost daily occurrence on Facebook over recent months. Typically they use the lure of an application that a potential victim's friend has been tricked into installing, such as a 'Dislike' button or a link to shocking (invariably bogus) news about a celebrity.
Instead of getting the promised content, victims are invited to navigate their way through a thicket of time-wasting surveys. Scammers earn a kick-back for each victim as affiliates of unethical marketing firms.
More ambitious (and lucrative) scams attempt to trick victims into supplying their mobile number, before signing up to a premium rate text messaging service of questionable utility.
The scams take advantage of human stupidity rather than web security vulnerabilities. Both Sophos and Facebook agree that user education is part of the solution, but the two are split on whether Facebook itself could do more to tighten up its controls on how applications are released onto its platform.
In a statement responding to Sophos' report, Facebook said it has plenty of controls already that limit access to information.
We have built extensive controls into the product, so that now when you add an application it only gets access to very limited data and the user must approve each additional type of data (so we do more than anyone else to educate users about passage of data, and force disclosure and user consent for each category beyond the basics).
We have a dedicated team that does robust review of all third party applications, using a risk based approach. So, that means that we first look at velocity/number of users/types of data shared, and prioritise. This ensures that the team is focused on addressing the biggest risks, rather than just doing a cursory review at the time that an app is first launched.
We make sure that we act swiftly to remove/sanction potentially bad applications before they gain access to data, and involve law enforcement and file civil actions if there is a problem.
Down with this sort of thing
Facebook said it is constantly improving the level of account protection offered to users, citing its introduction of one-time passwords back in October 2010, a development designed to make it safer for users to use public computers to access the service.
The social network goes on to list its user education programmes, which are geared to improving the security awareness levels of users.
These initiatives include updating the 3.6 million people who have liked the Facebook Security Page, hundreds of thousands of which have taken our "Stop. Think. Connect." quiz on the Page, which we developed with National Cyber Security Alliance and the Anti-Phishing Working Group; as well as the education we do through the product, for example, when we detect that an account is compromised by phishing or malware, we put the owner through a remediation/education process that includes a free McAfee virus scan.
When a person clicks on a link that we can't verify, or that we think might be suspicious, we pop an interstitial warning.
We put these points to Sophos, which said it stood by the main findings of its original report, and argued that the social network could and should do more to improve the security of its users.
"I definitely feel that Facebook could be doing more to both better secure their users, and to ensure that privacy is treated as a higher priority," Graham Cluley, senior technology consultant at Sophos, told El Reg.
Facebook may talk a good game but a quick search (viewable only if logged into Facebook and safe providing you don't click on the links) shows hundreds of victims have installed a rogue app that falsely promises the ability to "see who has viewed your profile".
Facebook ought to have someone searching for such scams and stamping them out, something that isn't happening as yet. "Often I see these scams spreading for days on end, with no obvious action taken by Facebook," Cluley said.
Careful now
According to Sophos, the social network could employ a round-the-clock security response team. Some have suggested Apple-style pre-approval of apps would drastically reduce, if not eliminate, the volume of crud circulating on Facebook. However, Cluley said such an approach was hard to apply to Facebook's platform.
"Pre-approval of apps is tricky, because they are web-based and contain content that is not hosted on Facebook's own servers," Cluley explained. "In other words, the bad guys could change it any time - turning a good app into a rogue one."
What might work better is some form of white-listing or restricting the ability to access sensitive data to already trusted developers, Cluley explained.
"Each app could be submitted for profiling to Facebook, who would create a matrix of what data it requested to access from the user, and which webpages it uses content from. If these changed at any point then the app would no longer be approved, and be sent back to Facebook's sinbin team for checking.
"Better than that would be for Facebook to only allow apps that came from approved developers to access sensitive information or post to users' walls."
Cluley said Facebook introduced an optional app verification program in November 2008, only to quietly kill it off a year later.
Facebook ought to consider reviving the program, said Cluley. "If developers had to pay to become official developers for the Facebook platform, and if not being an official developer meant you weren't able to hit Facebook users, then we'd see an instant dramatic drop in the attacks."
Sophos suggested that Facebook ought to be more proactive in using its security page as an early warning system on scams, as part of a broader program targeted at curtailing rogue apps and other security threats.
"There's a sliding scale of things that Facebook could do to counter the problem of rogue apps - ranging from faster response to stricter conditions about who and who can't write Facebook applications," Cluley concluded. "What's clear is that their current approach isn't working." ®
MY THOUGHTS
we have a choice, as always. if we're so heated up about our security and privacy there are, at least, 2 things we can do. one is to stop using facebook altogether.or be a responsible user.
Shy social network responds to criticism
By John Leyden • Get more from this author
Posted in Malware, 21st January 2011 16:01 GMT
Analysis Facebook has defended its record in thwarting rogue applications and other security in the face of criticism from security firms that it ought to adopt tighter application controls.
The dominant social network disputes findings from a threat report by UK-based net security firm Sophos, released earlier this week, that spam, malware and other attacks have become more effective against Facebook users over the last year.
Facebook reckons the opposite is true while disputing the methodology adopted by Sophos which it said looked, for example, at the volume of spam sent to Facebook users instead of the volume that reached their in-boxes.
Facebook said: "If your spam filter catches all the spam, does it matter that your filter caught 10 per cent more?"
The social networking site reckons less than three per cent of communications on Facebook are spam, compared to industry estimates that email spam makes up 90 per cent of all electronic messages. The implication is that Sophos is focusing on the wrong problem.
Unfriending rogues
Survey scams have become an almost daily occurrence on Facebook over recent months. Typically they use the lure of an application that a potential victim's friend has been tricked into installing, such as a 'Dislike' button or a link to shocking (invariably bogus) news about a celebrity.
Instead of getting the promised content, victims are invited to navigate their way through a thicket of time-wasting surveys. Scammers earn a kick-back for each victim as affiliates of unethical marketing firms.
More ambitious (and lucrative) scams attempt to trick victims into supplying their mobile number, before signing up to a premium rate text messaging service of questionable utility.
The scams take advantage of human stupidity rather than web security vulnerabilities. Both Sophos and Facebook agree that user education is part of the solution, but the two are split on whether Facebook itself could do more to tighten up its controls on how applications are released onto its platform.
In a statement responding to Sophos' report, Facebook said it has plenty of controls already that limit access to information.
We have built extensive controls into the product, so that now when you add an application it only gets access to very limited data and the user must approve each additional type of data (so we do more than anyone else to educate users about passage of data, and force disclosure and user consent for each category beyond the basics).
We have a dedicated team that does robust review of all third party applications, using a risk based approach. So, that means that we first look at velocity/number of users/types of data shared, and prioritise. This ensures that the team is focused on addressing the biggest risks, rather than just doing a cursory review at the time that an app is first launched.
We make sure that we act swiftly to remove/sanction potentially bad applications before they gain access to data, and involve law enforcement and file civil actions if there is a problem.
Down with this sort of thing
Facebook said it is constantly improving the level of account protection offered to users, citing its introduction of one-time passwords back in October 2010, a development designed to make it safer for users to use public computers to access the service.
The social network goes on to list its user education programmes, which are geared to improving the security awareness levels of users.
These initiatives include updating the 3.6 million people who have liked the Facebook Security Page, hundreds of thousands of which have taken our "Stop. Think. Connect." quiz on the Page, which we developed with National Cyber Security Alliance and the Anti-Phishing Working Group; as well as the education we do through the product, for example, when we detect that an account is compromised by phishing or malware, we put the owner through a remediation/education process that includes a free McAfee virus scan.
When a person clicks on a link that we can't verify, or that we think might be suspicious, we pop an interstitial warning.
We put these points to Sophos, which said it stood by the main findings of its original report, and argued that the social network could and should do more to improve the security of its users.
"I definitely feel that Facebook could be doing more to both better secure their users, and to ensure that privacy is treated as a higher priority," Graham Cluley, senior technology consultant at Sophos, told El Reg.
Facebook may talk a good game but a quick search (viewable only if logged into Facebook and safe providing you don't click on the links) shows hundreds of victims have installed a rogue app that falsely promises the ability to "see who has viewed your profile".
Facebook ought to have someone searching for such scams and stamping them out, something that isn't happening as yet. "Often I see these scams spreading for days on end, with no obvious action taken by Facebook," Cluley said.
Careful now
According to Sophos, the social network could employ a round-the-clock security response team. Some have suggested Apple-style pre-approval of apps would drastically reduce, if not eliminate, the volume of crud circulating on Facebook. However, Cluley said such an approach was hard to apply to Facebook's platform.
"Pre-approval of apps is tricky, because they are web-based and contain content that is not hosted on Facebook's own servers," Cluley explained. "In other words, the bad guys could change it any time - turning a good app into a rogue one."
What might work better is some form of white-listing or restricting the ability to access sensitive data to already trusted developers, Cluley explained.
"Each app could be submitted for profiling to Facebook, who would create a matrix of what data it requested to access from the user, and which webpages it uses content from. If these changed at any point then the app would no longer be approved, and be sent back to Facebook's sinbin team for checking.
"Better than that would be for Facebook to only allow apps that came from approved developers to access sensitive information or post to users' walls."
Cluley said Facebook introduced an optional app verification program in November 2008, only to quietly kill it off a year later.
Facebook ought to consider reviving the program, said Cluley. "If developers had to pay to become official developers for the Facebook platform, and if not being an official developer meant you weren't able to hit Facebook users, then we'd see an instant dramatic drop in the attacks."
Sophos suggested that Facebook ought to be more proactive in using its security page as an early warning system on scams, as part of a broader program targeted at curtailing rogue apps and other security threats.
"There's a sliding scale of things that Facebook could do to counter the problem of rogue apps - ranging from faster response to stricter conditions about who and who can't write Facebook applications," Cluley concluded. "What's clear is that their current approach isn't working." ®
MY THOUGHTS
we have a choice, as always. if we're so heated up about our security and privacy there are, at least, 2 things we can do. one is to stop using facebook altogether.or be a responsible user.
Subscribe to:
Posts (Atom)