Risk
1/24/2011
12:06 PM
Connect Directly
RSS
E-Mail
50%
50%

Facebook Defends Security Practices

The social network responds to report alleging it puts the safety of its 650 million users at risk by not better securing third-party applications.

Top 15 Facebook Apps For Business
(click image for larger view)
Slideshow: Top 15 Facebook Apps For Business

Is Facebook's app system inherently unsafe for the social network's 650 million users?

Responding to that exact criticism, the company last week issued a statement defending its security practices. "We have a dedicated team that does robust review of all third-party applications, using a risk-based approach. That means that we first look at velocity, number of users, types of data shared, and prioritize," said Facebook. "This ensures that the team is focused on addressing the biggest risks, rather than just doing a cursory review at the time that an app is first launched."

The company's statement was issued in reaction to a new threat report from Sophos, released on Wednesday. According to the report, "with furious debate raging every time privacy and security settings are tweaked on Facebook, it seems that functionality and ease-of-use triumph over security every time."

To better protect users, the report recommended that Facebook take a page from Apple and adopt a walled garden approach, in which applications would require "official approval before they can be uploaded to the site and shared with other users."

In its statement, however, Facebook seemed to stand by its post-screening security process. "We have built extensive controls into the product, so that now when you add an application it only gets access to very limited data and the user must approve each additional type of data," said Facebook. "We make sure that we act swiftly to remove/sanction potentially bad applications before they gain access to data, and involve law enforcement and file civil actions if there is a problem."

But Graham Cluley, senior technology consultant at Sophos, said the current approach can't keep up with the volume of new threats. "Facebook Security is effectively playing whack-a-mole, hammering the latest rogue app whenever they happen to spot it, and hoping that not too many accounts were compromised in the meantime. Unfortunately, quite often Facebook Security don't seem to spot the scams until they have spread far and wide."

Interestingly, the Sophos report released on Wednesday also found that "more than half of the companies surveyed imposed no limitations on accessing Facebook, Twitter, and LinkedIn -- and less than a quarter of firms completely block these sites."

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Dark Reading, September 16, 2014
Malicious software is morphing to be more targeted, stealthy, and destructive. Are you prepared to stop it?
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2006-1318
Published: 2014-09-19
Microsoft Office 2003 SP1 and SP2, Office XP SP3, Office 2000 SP3, Office 2004 for Mac, and Office X for Mac do not properly parse record lengths, which allows remote attackers to execute arbitrary code via a malformed control in an Office document, aka "Microsoft Office Control Vulnerability."

CVE-2014-1391
Published: 2014-09-19
QT Media Foundation in Apple OS X before 10.9.5 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted movie file with RLE encoding.

CVE-2014-4350
Published: 2014-09-19
Buffer overflow in QT Media Foundation in Apple OS X before 10.9.5 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted MIDI file.

CVE-2014-4376
Published: 2014-09-19
IOKit in IOAcceleratorFamily in Apple OS X before 10.9.5 allows attackers to execute arbitrary code in a privileged context or cause a denial of service (NULL pointer dereference) via an application that provides crafted API arguments.

CVE-2014-4390
Published: 2014-09-19
Bluetooth in Apple OS X before 10.9.5 does not properly validate API calls, which allows attackers to execute arbitrary code in a privileged context via a crafted application.

Best of the Web
Dark Reading Radio