Risk
1/24/2011
12:06 PM
Connect Directly
RSS
E-Mail
50%
50%

Facebook Defends Security Practices

The social network responds to report alleging it puts the safety of its 650 million users at risk by not better securing third-party applications.

Top 15 Facebook Apps For Business
(click image for larger view)
Slideshow: Top 15 Facebook Apps For Business

Is Facebook's app system inherently unsafe for the social network's 650 million users?

Responding to that exact criticism, the company last week issued a statement defending its security practices. "We have a dedicated team that does robust review of all third-party applications, using a risk-based approach. That means that we first look at velocity, number of users, types of data shared, and prioritize," said Facebook. "This ensures that the team is focused on addressing the biggest risks, rather than just doing a cursory review at the time that an app is first launched."

The company's statement was issued in reaction to a new threat report from Sophos, released on Wednesday. According to the report, "with furious debate raging every time privacy and security settings are tweaked on Facebook, it seems that functionality and ease-of-use triumph over security every time."

To better protect users, the report recommended that Facebook take a page from Apple and adopt a walled garden approach, in which applications would require "official approval before they can be uploaded to the site and shared with other users."

In its statement, however, Facebook seemed to stand by its post-screening security process. "We have built extensive controls into the product, so that now when you add an application it only gets access to very limited data and the user must approve each additional type of data," said Facebook. "We make sure that we act swiftly to remove/sanction potentially bad applications before they gain access to data, and involve law enforcement and file civil actions if there is a problem."

But Graham Cluley, senior technology consultant at Sophos, said the current approach can't keep up with the volume of new threats. "Facebook Security is effectively playing whack-a-mole, hammering the latest rogue app whenever they happen to spot it, and hoping that not too many accounts were compromised in the meantime. Unfortunately, quite often Facebook Security don't seem to spot the scams until they have spread far and wide."

Interestingly, the Sophos report released on Wednesday also found that "more than half of the companies surveyed imposed no limitations on accessing Facebook, Twitter, and LinkedIn -- and less than a quarter of firms completely block these sites."

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Flash Poll
Current Issue
Cartoon
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-0103
Published: 2014-07-29
WebAccess in Zarafa before 7.1.10 and WebApp before 1.6 stores credentials in cleartext, which allows local Apache users to obtain sensitive information by reading the PHP session files.

CVE-2014-0475
Published: 2014-07-29
Multiple directory traversal vulnerabilities in GNU C Library (aka glibc or libc6) before 2.20 allow context-dependent attackers to bypass ForceCommand restrictions and possibly have other unspecified impact via a .. (dot dot) in a (1) LC_*, (2) LANG, or other locale environment variable.

CVE-2014-0889
Published: 2014-07-29
Multiple cross-site scripting (XSS) vulnerabilities in IBM Atlas Suite (aka Atlas Policy Suite), as used in Atlas eDiscovery Process Management through 6.0.3, Disposal and Governance Management for IT through 6.0.3, and Global Retention Policy and Schedule Management through 6.0.3, allow remote atta...

CVE-2014-2226
Published: 2014-07-29
Ubiquiti UniFi Controller before 3.2.1 logs the administrative password hash in syslog messages, which allows man-in-the-middle attackers to obtains sensitive information via unspecified vectors.

CVE-2014-3020
Published: 2014-07-29
install.sh in the Embedded WebSphere Application Server (eWAS) 7.0 before FP33 in IBM Tivoli Integrated Portal (TIP) 2.1 and 2.2 sets world-writable permissions for the installRoot directory tree, which allows local users to gain privileges via a Trojan horse program.

Best of the Web
Dark Reading Radio