Posts Tagged ‘social networking’

Twitter has become a great way for friends and family to keep in touch throughout the day.  It’s become so popular that even celebrities provide daily updates so that they can keep track of each other and connect with their fans.

As is the case with many social networking sites, predators have been trying to capitalize on the weaknesses associated with using Twitter.  Whether someone has created an account for the sole purpose of befriending potential identity theft victims or the profile just pumps out spam, not everything on the popular site is as it seems (read about how scammers are abusing Twitter).

Twitter has decided to take action by adding a “report as spam” feature which can be found under the “Actions” section of a profile’s sidebar.

Once a user has been reported, Twitter’s Trust and Safety team investigates the situation and makes decisions regarding what action, if any, should be taken.  Users who click the “report as spam” button will automatically have the profile blocked from following or replying to them.

I think this is a step in the right direction and, hopefully, will help deter spammers and scammers from using Twitter as a way of hurting others.  It’s important since cybercrime on social networking sites is on the rise.

Earlier this month we talked bout “scareware“. One such attack recently was perpetrated through the popular social networking site Twitter. In fact, this week I have witnessed several different phishing schemes on Twitter.

1. Scareware Scam: Scammers were found to be using machine-generated Twitter accounts to post messages about popular topics. Each of these messages would include a link, often disguised using a link-shortening service (making it difficult to know where the link would lead). The link would lead to servers hosting fake Windows antivirus software.

2. DMs that Steal Logins: This second scam would use hacked accounts to send direct messages (DMs) to users. Clicking the link in the scam would take you to a fake login page in a ploy to steal your login information. This scam would then perpetrate to all the friends of the compromised account. Receiving direct messages with links from “friends” increases the likelihood these links will be clicked.

3. Baiting Users: I have witnessed attempts by several auto-generated accounts to bait particular users. To do so, they will accuse the user of something, such as a political stance, in repeated @ messages. This will be retweeted or continued by a whole series of other accounts. In all cases, the accounts will have other “real” looking tweets with links in them, trying to bait you to check the account and click the links.

In reference to the second scam, I know of individuals who had their accounts breached without handing over their passwords, so it’s imperative that anyone who has received direct messages with links not click those links. If you do, change your password right away and contact Twitter support to report the issue.

I myself have been baited by many of these schemes, but I never click the links. Here, for example, is one a “friend” sent me yesterday:

If you are unsure about a particular link, don’t click it. If it is a shortened URL, you can see what it leads to with a service such as LongURL. If you use Firefox and want added protection from cross-site scripting attacks, you can install the NoScript plugin.

Via mashable, computer world

Sophos has released its mid-year Security Threat Report for 2009, which looks at cybercrime for the first half of this year. The report indicates that cybercriminals have increased the focus of their attacks on social networking sites and that hackers are increasingly using scare tactics to solicit users to pay for rogue anti-virus software.

The report indicates that cybercriminals are both exploiting social networks to identify potential victims and then using these networks to attack them. The report encourages Web 2.0 companies to defend their existing users, rather than focusing on growing their userbase at the expense of security standards.

In terms of business data, the survey indicates that two thirds of businesses are worried that information shared by employees online may put their corporate infrastructure at risk. Right now, a quarter of organizations have been exposed to spam, phishing or malware via social networking sites like Facebook, Twitter and MySpace.

Read more about, and download, the report here.

According to a new report from Sophos, two thirds of businesses fear social networking and its impact on corporate security.

Sophos conducted a poll in February 2009 with 709 respondents. Of those, 63% of system administrators worry that employees share too much information on their social networking profiles. They believe this puts the corporation, and its data, at risk (since cybercriminals have access to more information for identity theft, malware or spam). A quarter of the businesses had been the recipients of spam, phishing or malware attacks via sites like Twitter, Facebook, LinkedIn and MySpace.

Over 40% of companies don’t control access to any of these major social networking platforms – for those that do, productivity still represents the largest share of concern, but security concerns are on the rise.

“We’re seeing more incidents of unwanted adverts and malicious links being spammed out, particularly to Facebook users, from their friends’ compromised accounts. Although social networking sites are going some way to mitigate threats to users – activating pop-up windows to confirm if a user really wants to visit that external link for example – unfortunately it’s just not enough. Organisations need to incorporate defences into their IT security policy, and a key part of this is to educate individuals to choose strong passwords and to take good care of them to prevent cybercriminals taking over online accounts which could provide an entry point to the IT infrastructure.” – Graham Cluley, senior technology consultant at Sophos

Sophos summarizes their study with the top 5 tips to combat social networking perils in the business environment, which include:

• Educate your workforce about online risks
• Consider filtering access to certain social networking sites at specific times
• Check the information that your organisation and staff share online
• Review your Web 2.0 security settings regularly
• Ensure that you have a solution in place that can proactively scan all websites for malware, spam and phishing content

Read more here.

Also, beware of an increase in Swine Flu pill spam!

Infection from the “VideoPlay” adware has been on the rise, just one indication that social media is being targeted for malware attacks. This particular adware, which is spread through malicious posts and comments on sites like Digg and YouTube, went up 400% from January to February.

What is adware? “Any software package which automatically plays, displays, or downloads advertisements to a computer after the software is installed on it or while the application is being used.” – Wikipedia

The VideoPlay adware is a worm that aims to steal login information as well as any other information stored in a user’s browser – such as passwords. The worm can then use stolen access, such as that for social networking sites, to leave more malicious comments.

On Digg.com, the VideoPlay adware was left in comments. The comment would contain a link to a celebrity video, many of which prey upon videos already popular, or a pornographic video. However, the link would prompt users to download a codec to view the video file – this would contain the adware. The comments are being left via an automated script with more than 500,000 malicious comments tracked, according to SC Magazine.

The YouTube hosting of the VideoPlay adware is occurring through the Annotations feature to point to a URL left in the video information box. The malware is not as prevalent on YouTube yet, but it’s only time before more attacks of this sort begin to spread through social media sites.

The increase in the infection rate of the worm indicates that the adware strategy is working. Be wary when clicking links and don’t fall for strategies that require you to install new ’software’ to view any videos.

Following the publicized hacks of ‘big’ accounts (Britney Spears, Barack Obama, Fox News) on the social networking site Twitter, Sophos is calling on Twitter to enforce stronger password security (though, really, every company should enforce strong password standards of its users).

An 18-year-old with a history of celebrity pranks has admitted to hacking several high-profile Twitter accounts. The hacker, GMZ, says he was able to use an automated password-guesser to do a “brute force” attack to guess the password of a Twitter user. Since Twitter allowed an unlimited number of login attempts (a poor security tactic), the hack was easy. The password of one account was as simple as “happiness”, a very insecure password.

Although he didn’t realize it at first, he’d hacked into a Twitter staffer, and that opened up the ability to reset the password on any Twitter account. For fun, he asked other hackers if they wanted access to any Twitter account and posted a video he made of his hack:

DMZ then filled requests to access several high profile accounts, including Barack Obama’s account and Britney Spears’ account. Those accounts were then hijacked and they sent fake messages, as demonstrated here. DMZ was in Twitter for a couple of hours before his access was blocked by Twitter.

Twitter says they are doing a full security review and are already at work to strengthen the sign-in process. This security issue came immediately on the heels of a Twitter phishing scam.

This piece of news has prompted Bruce Schneier to write a great article reminding us that technology is only part of the solution to security issues. The article talks mostly about the threats of impersonation, not web security, but it’s a great read.

BTW, if you are a Twitter user, you can follow Absolute Software news at: twitter.com/absolutecorp.

A number of great articles have come to the forefront in the news of late about the risks of social networking and privacy. Specifically, privacy issues that are the result of users (mostly younger people) sharing too much information online.

Many teens would be astonished to know how much information about themselves that someone could glean from their Facebook profile, for example. Or how much additional information can be gleaned by using free tools like Canada411.com. Phone numbers, home addresses, schools – all of this information poses a security risk to young people when posted online. Not to mention all the photos. Identity theft becomes an issue, in addition to risks to ones reputation or even personal safety.

comScore indicates that nearly 17 million Canadians are on Facebook, and 4.5 million are on MySpace. The Globe and Mail recently completed a 2 month investigation of social networking sites to prove a point about the information a casual observer can gather on an individual.

Anastasia Goodstein, author of Totally Wired: What Teens and Tweens are Really Doing Online, believes that teens are pre-conditioned to sharing personal information because of a level of openness that is reflected to them in reality television. Attention is sought after, and part of that involves openly sharing minute details of one’s life, and privacy goes out the window.

That said, somewhere in the area of 30-40% of Facebook users actually read and modify their privacy settings, opposed to less than 1% on most other websites. In terms of privacy, 100% of people need to be aware of the privacy options available to them, and also of the risks associated with exposing certain types of information.

A whole new industry has sprung up to help people clean up information they have shared online. For example, parents will hire a company to clean up the social networking profiles of their kids as they graduate from university. Research indicates that 77% of employers check social networking profiles, so this isn’t a bad idea.

Continue reading more here or read about 5 ways to save face with Facebook here.