01:28 PM

Social Spam Invades The Enterprise

Spammers increasingly dodge email spam tools by using social media, posing new risks to government and corporate enterprises, study says.

Top 10 Government IT Innovators Of 2013
Top 10 Government IT Innovators Of 2013
(click image for larger view)
Social media hasn't yet displaced email for day-to-day office communications, but it has taken on one of email's most pervasive and onerous qualities: relentless spam.

Spammers are using social media to circumvent conventional security methods that provided at least some ability to detect and quarantine unwanted email.

Just how much spam is pouring in through social media is presented in a new report on social spam from Nexgate, which has a stake in social media security.

Nexgate data scientists analyzed more than 60 million pieces of unique social content published on more than 25 million social accounts, and concluded:

-- During the first six months of 2013 there was a 355% growth of social spam.

[ Read how Google got in trouble for partnering with a texting service. Google Settles Text Spam Suit For $6 Million. ]

-- 15% of all social spam contains a URL, often to spammy content, pornography or malware.

-- One in 21 social media messages across Facebook, YouTube, Google+ and Twitter contains risky content, such as adult language, private or regulated data, or spam.

-- One in 200 social media messages contain spam, including lures to adult content and malware.

-- Facebook contains the highest number of phishing attempts and personally identifiable information; in fact, more than four times the other social media networks.

-- YouTube contains the most "risky" content -- containing profanity, threats, hate speech or insults. For every one piece of risky content found on other social media networks, there are five pieces on YouTube.

The rise of social media spam is creating a new set of issues not only for corporate and government social media managers, but also their IT security teams.

"Spam isn't just an annoyance issue for federal employees," said Justin Herman, social media lead for the General Services Administration, which helps federal agencies develop their public-facing social media strategies. "It can also be a security issue if used maliciously."

The GSA's Office of Citizen Services and Innovative Technologies, where Herman works, is already guiding and training agencies on how to handle social spam messages "as part of our larger social media management and security programs," he said. He warns users, for instance, to guard against social media posts that offer a link and read: "Did you see this tweet about you?"

GSA offers online tutorials for government social media managers, through its DigitalGov University. One tutorial, "Minimize IT Security Risks While Using Social Media," helps agencies recognize spam and its role in the broader scope of IT management. GSA also issues periodic reports that provide specific guidance on responding to social media attacks.

For commercial enterprises, social spam also represents a growing financial cost, said Devin Redmond, co-founder and CEO of Nexgate, who calls it "a significant burden to big brands" and a drain on media marketing programs.

The fact that spammers can target entire online communities in a single post, and have that post distributed to others, makes it a greater threat than conventional email spam. Social spam is also becoming more complex.

Text- and link-based spam are the most popular types, while" Like-jacking," social bots, spammy apps and fake accounts are the most prevalent forms of distribution.

"Traditional email, Web and antivirus solutions just don't work in social media," a Nexgate spokesman said.

Comment  | 
Print  | 
More Insights
Newest First  |  Oldest First  |  Threaded View
User Rank: Apprentice
9/26/2013 | 8:48:48 PM
re: Social Spam Invades The Enterprise
On a side note, GSA's DigitalGov University is becoming a great resource for federal employees who aren't necessarily involved in their agencies social media campaigns.

Check out "Minimize IT Security Risks While Using Social Media," which helps agencies recognize spam.
Register for Dark Reading Newsletters
White Papers
Current Issue
Dark Reading Tech Digest September 7, 2015
Some security flaws go beyond simple app vulnerabilities. Have you checked for these?
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
Published: 2015-10-09
Simple Streams (simplestreams) does not properly verify the GPG signatures of disk image files, which allows remote mirror servers to spoof disk images and have unspecified other impact via a 403 (aka Forbidden) response.

Published: 2015-10-09
The Telephony component in Apple OS X before 10.11, when the Continuity feature is enabled, allows local users to bypass intended telephone-call restrictions via unspecified vectors.

Published: 2015-10-09
IcedTea-Web before 1.5.3 and 1.6.x before 1.6.1 does not properly sanitize applet URLs, which allows remote attackers to inject applets into the .appletTrustSettings configuration file and bypass user approval to execute the applet via a crafted web page, possibly related to line breaks.

Published: 2015-10-09
IcedTea-Web before 1.5.3 and 1.6.x before 1.6.1 does not properly determine the origin of unsigned applets, which allows remote attackers to bypass the approval process or trick users into approving applet execution via a crafted web page.

Published: 2015-10-09
The Safari Extensions implementation in Apple Safari before 9 does not require user confirmation before replacing an installed extension, which has unspecified impact and attack vectors.

Dark Reading Radio
Archived Dark Reading Radio
What can the information security industry do to solve the IoT security problem? Learn more and join the conversation on the next episode of Dark Reading Radio.