Analytics // Threat Intelligence
3/26/2014
06:50 PM
Connect Directly
Google+
Twitter
RSS
E-Mail
50%
50%

Facebook Builds Its Own Threat Modeling System

The tool helps the social network gather, store, analyze, and react to the latest threats against it.

Facebook has created its own threat intelligence tool to help keep tabs on malware, phishing, and other threats on the Internet that could threaten the social network. The new ThreatData framework pulls threat feeds from outside sources, stores that information, and allows the social media giant to translate that information into action for real-time defense.

Mark Hammell, a threat researcher at Facebook who blogged about the new homegrown framework yesterday, says ThreatData also has helped the social networking company spot new types of threats. Last summer, for example, the tool provided data on a trend in malware samples using a particular string in an antivirus signature: turned out it was a spam campaign of fake Facebook accounts that tried to push mobile phone malware.  

"The malware, specifically the Trojan:J2ME/Boxer family [3], was capable of stealing a victim's address book, sending premium SMS spam, and using the phone's camera to take pictures. With this discovery, we were able to analyze the malware, disrupt the spam campaign, and work with partners to disrupt the botnet's infrastructure," Hammell said.

ThreatData draws from VirusTotal, vendor-generated threat intel feeds, open-source data on malicious URLs and malware tracking sites, as well as Facebook's own internal threat intelligence findings. It then generates real-time response to any new threats.

Hammell says that automated function is rooted in a processor Facebook built to analyze the incoming data and to automatically act on the new threats. "All malicious URLs collected from any feed are sent to the same blacklist used to protect people on facebook.com," he said. "Interesting malware file hashes are automatically downloaded from known malware repositories, stored, and sent for automated analysis; and threat data is propagated to our homegrown security event management system, which is used to protect Facebook's corporate networks."

Why the homegrown tool approach? "Given the pace of criminals today, one of the hard parts is actually keeping track of all the data related to malware, phishing, and other risks. We wanted an easier way to organize our work and incorporate new threat information we receive so that we can do more to protect people," Hammell said. "We've found that the framework lets us easily incorporate fresh types of data and quickly hook into new and existing internal systems, regardless of their technology stack or how they conceptualize threats."

The announcement of Facebook's ThreatData tool is yet another security move by the social media giant, which has paid out more than $2 million to outside researchers as part of its bug bounty program and of late has been forthcoming about its strategy building a security culture internally.

Facebook CSO Joe Sullivan says the social media giant has made security part of the social media giant's culture so that security is part of all of the daily lives of all of its employees. "It's important to get the whole company thinking about security," Sullivan said in a press briefing last week.

Kelly Jackson Higgins is Executive Editor at DarkReading.com. She is an award-winning veteran technology and business journalist with more than two decades of experience in reporting and editing for various publications, including Network Computing, Secure Enterprise ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
DoctorSecurity
100%
0%
DoctorSecurity,
User Rank: Apprentice
3/27/2014 | 12:30:27 PM
Re: curiouser and curiouser...
Facebook pulls threat data from outside sources, they are not the ones providing it.
kjhiggins
50%
50%
kjhiggins,
User Rank: Strategist
3/26/2014 | 9:07:42 PM
Re: Facebook's security culture
Facebook is actually quite proactive in its internal security awareness training/programs and in engaging and empowering users. FB CSO Sullivan says the goal is to make security part of the culture for each and every employee....awareness of phishing emails, etc. They use creative programs and competitions as well.
Sara Peters
0%
100%
Sara Peters,
User Rank: Author
3/26/2014 | 9:05:47 PM
curiouser and curiouser...
I'm of two minds about this. On one hand, it's nice to know that an organization that has access to so much personal data is taking security seriously. On the other hand, my gut reaction is still "Is Facebook really who I want to get my threat data from?" Am I the only one who finds this a little oogy?

 
Marilyn Cohodas
50%
50%
Marilyn Cohodas,
User Rank: Strategist
3/26/2014 | 8:52:16 PM
Facebook's security culture
Interesting article Kelly. I'm curious -- outside of its homegrown threat modeling tool is Facebook doing anything to make its employees and culture more security-aware?

 
Register for Dark Reading Newsletters
Partner Perspectives
What's This?
In a digital world inundated with advanced security threats, Intel Security seeks to transform how we live and work to keep our information secure. Through hardware and software development, Intel Security delivers robust solutions that integrate security into every layer of every digital device. In combining the security expertise of McAfee with the innovation, performance, and trust of Intel, this vision becomes a reality.

As we rely on technology to enhance our everyday and business life, we must too consider the security of the intellectual property and confidential data that is housed on these devices. As we increase the number of devices we use, we increase the number of gateways and opportunity for security threats. Intel Security takes the “security connected” approach to ensure that every device is secure, and that all security solutions are seamlessly integrated.
Featured Writers
White Papers
Cartoon
Current Issue
Dark Reading's October Tech Digest
Fast data analysis can stymie attacks and strengthen enterprise security. Does your team have the data smarts?
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2013-7407
Published: 2014-10-22
Cross-site request forgery (CSRF) vulnerability in the MRBS module for Drupal allows remote attackers to hijack the authentication of unspecified victims via unknown vectors.

CVE-2014-3675
Published: 2014-10-22
Shim allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted DHCPv6 packet.

CVE-2014-3676
Published: 2014-10-22
Heap-based buffer overflow in Shim allows remote attackers to execute arbitrary code via a crafted IPv6 address, related to the "tftp:// DHCPv6 boot option."

CVE-2014-3677
Published: 2014-10-22
Unspecified vulnerability in Shim might allow attackers to execute arbitrary code via a crafted MOK list, which triggers memory corruption.

CVE-2014-4448
Published: 2014-10-22
House Arrest in Apple iOS before 8.1 relies on the hardware UID for its encryption key, which makes it easier for physically proximate attackers to obtain sensitive information from a Documents directory by obtaining this UID.

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
Follow Dark Reading editors into the field as they talk with noted experts from the security world.