Analytics // Threat Intelligence
3/26/2014
06:50 PM
Connect Directly
Google+
Twitter
RSS
E-Mail
50%
50%

Facebook Builds Its Own Threat Modeling System

The tool helps the social network gather, store, analyze, and react to the latest threats against it.

Facebook has created its own threat intelligence tool to help keep tabs on malware, phishing, and other threats on the Internet that could threaten the social network. The new ThreatData framework pulls threat feeds from outside sources, stores that information, and allows the social media giant to translate that information into action for real-time defense.

Mark Hammell, a threat researcher at Facebook who blogged about the new homegrown framework yesterday, says ThreatData also has helped the social networking company spot new types of threats. Last summer, for example, the tool provided data on a trend in malware samples using a particular string in an antivirus signature: turned out it was a spam campaign of fake Facebook accounts that tried to push mobile phone malware.  

"The malware, specifically the Trojan:J2ME/Boxer family [3], was capable of stealing a victim's address book, sending premium SMS spam, and using the phone's camera to take pictures. With this discovery, we were able to analyze the malware, disrupt the spam campaign, and work with partners to disrupt the botnet's infrastructure," Hammell said.

ThreatData draws from VirusTotal, vendor-generated threat intel feeds, open-source data on malicious URLs and malware tracking sites, as well as Facebook's own internal threat intelligence findings. It then generates real-time response to any new threats.

Hammell says that automated function is rooted in a processor Facebook built to analyze the incoming data and to automatically act on the new threats. "All malicious URLs collected from any feed are sent to the same blacklist used to protect people on facebook.com," he said. "Interesting malware file hashes are automatically downloaded from known malware repositories, stored, and sent for automated analysis; and threat data is propagated to our homegrown security event management system, which is used to protect Facebook's corporate networks."

Why the homegrown tool approach? "Given the pace of criminals today, one of the hard parts is actually keeping track of all the data related to malware, phishing, and other risks. We wanted an easier way to organize our work and incorporate new threat information we receive so that we can do more to protect people," Hammell said. "We've found that the framework lets us easily incorporate fresh types of data and quickly hook into new and existing internal systems, regardless of their technology stack or how they conceptualize threats."

The announcement of Facebook's ThreatData tool is yet another security move by the social media giant, which has paid out more than $2 million to outside researchers as part of its bug bounty program and of late has been forthcoming about its strategy building a security culture internally.

Facebook CSO Joe Sullivan says the social media giant has made security part of the social media giant's culture so that security is part of all of the daily lives of all of its employees. "It's important to get the whole company thinking about security," Sullivan said in a press briefing last week.

Kelly Jackson Higgins is Executive Editor at DarkReading.com. She is an award-winning veteran technology and business journalist with more than two decades of experience in reporting and editing for various publications, including Network Computing, Secure Enterprise ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
DoctorSecurity
100%
0%
DoctorSecurity,
User Rank: Apprentice
3/27/2014 | 12:30:27 PM
Re: curiouser and curiouser...
Facebook pulls threat data from outside sources, they are not the ones providing it.
kjhiggins
50%
50%
kjhiggins,
User Rank: Strategist
3/26/2014 | 9:07:42 PM
Re: Facebook's security culture
Facebook is actually quite proactive in its internal security awareness training/programs and in engaging and empowering users. FB CSO Sullivan says the goal is to make security part of the culture for each and every employee....awareness of phishing emails, etc. They use creative programs and competitions as well.
Sara Peters
0%
100%
Sara Peters,
User Rank: Author
3/26/2014 | 9:05:47 PM
curiouser and curiouser...
I'm of two minds about this. On one hand, it's nice to know that an organization that has access to so much personal data is taking security seriously. On the other hand, my gut reaction is still "Is Facebook really who I want to get my threat data from?" Am I the only one who finds this a little oogy?

 
Marilyn Cohodas
50%
50%
Marilyn Cohodas,
User Rank: Strategist
3/26/2014 | 8:52:16 PM
Facebook's security culture
Interesting article Kelly. I'm curious -- outside of its homegrown threat modeling tool is Facebook doing anything to make its employees and culture more security-aware?

 
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2013-2184
Published: 2015-03-27
Movable Type before 5.2.6 does not properly use the Storable::thaw function, which allows remote attackers to execute arbitrary code via the comment_state parameter.

CVE-2014-3619
Published: 2015-03-27
The __socket_proto_state_machine function in GlusterFS 3.5 allows remote attackers to cause a denial of service (infinite loop) via a "00000000" fragment header.

CVE-2014-8121
Published: 2015-03-27
DB_LOOKUP in nss_files/files-XXX.c in the Name Service Switch (NSS) in GNU C Library (aka glibc or libc6) 2.21 and earlier does not properly check if a file is open, which allows remote attackers to cause a denial of service (infinite loop) by performing a look-up while the database is iterated over...

CVE-2014-9712
Published: 2015-03-27
Websense TRITON V-Series appliances before 7.8.3 Hotfix 03 and 7.8.4 before Hotfix 01 allows remote administrators to read arbitrary files and obtain passwords via a crafted path.

CVE-2015-2157
Published: 2015-03-27
The (1) ssh2_load_userkey and (2) ssh2_save_userkey functions in PuTTY 0.51 through 0.63 do not properly wipe SSH-2 private keys from memory, which allows local users to obtain sensitive information by reading the memory.

Dark Reading Radio
Archived Dark Reading Radio
Good hackers--aka security researchers--are worried about the possible legal and professional ramifications of President Obama's new proposed crackdown on cyber criminals.