Risk
1/24/2011
12:06 PM
Connect Directly
RSS
E-Mail
50%
50%

Facebook Defends Security Practices

The social network responds to report alleging it puts the safety of its 650 million users at risk by not better securing third-party applications.

Top 15 Facebook Apps For Business
(click image for larger view)
Slideshow: Top 15 Facebook Apps For Business

Is Facebook's app system inherently unsafe for the social network's 650 million users?

Responding to that exact criticism, the company last week issued a statement defending its security practices. "We have a dedicated team that does robust review of all third-party applications, using a risk-based approach. That means that we first look at velocity, number of users, types of data shared, and prioritize," said Facebook. "This ensures that the team is focused on addressing the biggest risks, rather than just doing a cursory review at the time that an app is first launched."

The company's statement was issued in reaction to a new threat report from Sophos, released on Wednesday. According to the report, "with furious debate raging every time privacy and security settings are tweaked on Facebook, it seems that functionality and ease-of-use triumph over security every time."

To better protect users, the report recommended that Facebook take a page from Apple and adopt a walled garden approach, in which applications would require "official approval before they can be uploaded to the site and shared with other users."

In its statement, however, Facebook seemed to stand by its post-screening security process. "We have built extensive controls into the product, so that now when you add an application it only gets access to very limited data and the user must approve each additional type of data," said Facebook. "We make sure that we act swiftly to remove/sanction potentially bad applications before they gain access to data, and involve law enforcement and file civil actions if there is a problem."

But Graham Cluley, senior technology consultant at Sophos, said the current approach can't keep up with the volume of new threats. "Facebook Security is effectively playing whack-a-mole, hammering the latest rogue app whenever they happen to spot it, and hoping that not too many accounts were compromised in the meantime. Unfortunately, quite often Facebook Security don't seem to spot the scams until they have spread far and wide."

Interestingly, the Sophos report released on Wednesday also found that "more than half of the companies surveyed imposed no limitations on accessing Facebook, Twitter, and LinkedIn -- and less than a quarter of firms completely block these sites."

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Flash Poll
Current Issue
Cartoon
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-4734
Published: 2014-07-21
Cross-site scripting (XSS) vulnerability in e107_admin/db.php in e107 2.0 alpha2 and earlier allows remote attackers to inject arbitrary web script or HTML via the type parameter.

CVE-2014-4960
Published: 2014-07-21
Multiple SQL injection vulnerabilities in models\gallery.php in Youtube Gallery (com_youtubegallery) component 4.x through 4.1.7, and possibly 3.x, for Joomla! allow remote attackers to execute arbitrary SQL commands via the (1) listid or (2) themeid parameter to index.php.

CVE-2014-5016
Published: 2014-07-21
Multiple cross-site scripting (XSS) vulnerabilities in LimeSurvey 2.05+ Build 140618 allow remote attackers to inject arbitrary web script or HTML via (1) the pid attribute to the getAttribute_json function to application/controllers/admin/participantsaction.php in CPDB, (2) the sa parameter to appl...

CVE-2014-5017
Published: 2014-07-21
SQL injection vulnerability in CPDB in application/controllers/admin/participantsaction.php in LimeSurvey 2.05+ Build 140618 allows remote attackers to execute arbitrary SQL commands via the sidx parameter in a JSON request to admin/participants/sa/getParticipants_json, related to a search parameter...

CVE-2014-5018
Published: 2014-07-21
Incomplete blacklist vulnerability in the autoEscape function in common_helper.php in LimeSurvey 2.05+ Build 140618 allows remote attackers to conduct cross-site scripting (XSS) attacks via the GBK charset in the loadname parameter to index.php, related to the survey resume.

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
Where do information security startups come from? More important, how can I tell a good one from a flash in the pan? Learn how to separate ITSec wheat from chaff in this episode.