Analytics // Threat Intelligence
3/26/2014
06:50 PM
Connect Directly
Google+
Twitter
RSS
E-Mail
50%
50%

Facebook Builds Its Own Threat Modeling System

The tool helps the social network gather, store, analyze, and react to the latest threats against it.

Facebook has created its own threat intelligence tool to help keep tabs on malware, phishing, and other threats on the Internet that could threaten the social network. The new ThreatData framework pulls threat feeds from outside sources, stores that information, and allows the social media giant to translate that information into action for real-time defense.

Mark Hammell, a threat researcher at Facebook who blogged about the new homegrown framework yesterday, says ThreatData also has helped the social networking company spot new types of threats. Last summer, for example, the tool provided data on a trend in malware samples using a particular string in an antivirus signature: turned out it was a spam campaign of fake Facebook accounts that tried to push mobile phone malware.  

"The malware, specifically the Trojan:J2ME/Boxer family [3], was capable of stealing a victim's address book, sending premium SMS spam, and using the phone's camera to take pictures. With this discovery, we were able to analyze the malware, disrupt the spam campaign, and work with partners to disrupt the botnet's infrastructure," Hammell said.

ThreatData draws from VirusTotal, vendor-generated threat intel feeds, open-source data on malicious URLs and malware tracking sites, as well as Facebook's own internal threat intelligence findings. It then generates real-time response to any new threats.

Hammell says that automated function is rooted in a processor Facebook built to analyze the incoming data and to automatically act on the new threats. "All malicious URLs collected from any feed are sent to the same blacklist used to protect people on facebook.com," he said. "Interesting malware file hashes are automatically downloaded from known malware repositories, stored, and sent for automated analysis; and threat data is propagated to our homegrown security event management system, which is used to protect Facebook's corporate networks."

Why the homegrown tool approach? "Given the pace of criminals today, one of the hard parts is actually keeping track of all the data related to malware, phishing, and other risks. We wanted an easier way to organize our work and incorporate new threat information we receive so that we can do more to protect people," Hammell said. "We've found that the framework lets us easily incorporate fresh types of data and quickly hook into new and existing internal systems, regardless of their technology stack or how they conceptualize threats."

The announcement of Facebook's ThreatData tool is yet another security move by the social media giant, which has paid out more than $2 million to outside researchers as part of its bug bounty program and of late has been forthcoming about its strategy building a security culture internally.

Facebook CSO Joe Sullivan says the social media giant has made security part of the social media giant's culture so that security is part of all of the daily lives of all of its employees. "It's important to get the whole company thinking about security," Sullivan said in a press briefing last week.

Kelly Jackson Higgins is Executive Editor at DarkReading.com. She is an award-winning veteran technology and business journalist with more than two decades of experience in reporting and editing for various publications, including Network Computing, Secure Enterprise ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
DoctorSecurity
100%
0%
DoctorSecurity,
User Rank: Apprentice
3/27/2014 | 12:30:27 PM
Re: curiouser and curiouser...
Facebook pulls threat data from outside sources, they are not the ones providing it.
kjhiggins
50%
50%
kjhiggins,
User Rank: Strategist
3/26/2014 | 9:07:42 PM
Re: Facebook's security culture
Facebook is actually quite proactive in its internal security awareness training/programs and in engaging and empowering users. FB CSO Sullivan says the goal is to make security part of the culture for each and every employee....awareness of phishing emails, etc. They use creative programs and competitions as well.
Sara Peters
0%
100%
Sara Peters,
User Rank: Author
3/26/2014 | 9:05:47 PM
curiouser and curiouser...
I'm of two minds about this. On one hand, it's nice to know that an organization that has access to so much personal data is taking security seriously. On the other hand, my gut reaction is still "Is Facebook really who I want to get my threat data from?" Am I the only one who finds this a little oogy?

 
Marilyn Cohodas
50%
50%
Marilyn Cohodas,
User Rank: Strategist
3/26/2014 | 8:52:16 PM
Facebook's security culture
Interesting article Kelly. I'm curious -- outside of its homegrown threat modeling tool is Facebook doing anything to make its employees and culture more security-aware?

 
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-3345
Published: 2014-08-28
The web framework in Cisco Transport Gateway for Smart Call Home (aka TG-SCH or Transport Gateway Installation Software) 4.0 does not properly check authorization for administrative web pages, which allows remote attackers to modify the product via a crafted URL, aka Bug ID CSCuq31503.

CVE-2014-3347
Published: 2014-08-28
Cisco IOS 15.1(4)M2 on Cisco 1800 ISR devices, when the ISDN Basic Rate Interface is enabled, allows remote attackers to cause a denial of service (device hang) by leveraging knowledge of the ISDN phone number to trigger an interrupt timer collision during entropy collection, leading to an invalid s...

CVE-2014-4199
Published: 2014-08-28
vm-support 0.88 in VMware Tools, as distributed with VMware Workstation through 10.0.3 and other products, allows local users to write to arbitrary files via a symlink attack on a file in /tmp.

CVE-2014-4200
Published: 2014-08-28
vm-support 0.88 in VMware Tools, as distributed with VMware Workstation through 10.0.3 and other products, uses 0644 permissions for the vm-support archive, which allows local users to obtain sensitive information by extracting files from this archive.

CVE-2014-0761
Published: 2014-08-27
The DNP3 driver in CG Automation ePAQ-9410 Substation Gateway allows remote attackers to cause a denial of service (infinite loop or process crash) via a crafted TCP packet.

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
This episode of Dark Reading Radio looks at infosec security from the big enterprise POV with interviews featuring Ron Plesco, Cyber Investigations, Intelligence & Analytics at KPMG; and Chris Inglis & Chris Bell of Securonix.