Risk
9/25/2013
01:28 PM
50%
50%

Social Spam Invades The Enterprise

Spammers increasingly dodge email spam tools by using social media, posing new risks to government and corporate enterprises, study says.

Top 10 Government IT Innovators Of 2013
Top 10 Government IT Innovators Of 2013
(click image for larger view)
Social media hasn't yet displaced email for day-to-day office communications, but it has taken on one of email's most pervasive and onerous qualities: relentless spam.

Spammers are using social media to circumvent conventional security methods that provided at least some ability to detect and quarantine unwanted email.

Just how much spam is pouring in through social media is presented in a new report on social spam from Nexgate, which has a stake in social media security.

Nexgate data scientists analyzed more than 60 million pieces of unique social content published on more than 25 million social accounts, and concluded:

-- During the first six months of 2013 there was a 355% growth of social spam.

[ Read how Google got in trouble for partnering with a texting service. Google Settles Text Spam Suit For $6 Million. ]

-- 15% of all social spam contains a URL, often to spammy content, pornography or malware.

-- One in 21 social media messages across Facebook, YouTube, Google+ and Twitter contains risky content, such as adult language, private or regulated data, or spam.

-- One in 200 social media messages contain spam, including lures to adult content and malware.

-- Facebook contains the highest number of phishing attempts and personally identifiable information; in fact, more than four times the other social media networks.

-- YouTube contains the most "risky" content -- containing profanity, threats, hate speech or insults. For every one piece of risky content found on other social media networks, there are five pieces on YouTube.

The rise of social media spam is creating a new set of issues not only for corporate and government social media managers, but also their IT security teams.

"Spam isn't just an annoyance issue for federal employees," said Justin Herman, social media lead for the General Services Administration, which helps federal agencies develop their public-facing social media strategies. "It can also be a security issue if used maliciously."

The GSA's Office of Citizen Services and Innovative Technologies, where Herman works, is already guiding and training agencies on how to handle social spam messages "as part of our larger social media management and security programs," he said. He warns users, for instance, to guard against social media posts that offer a link and read: "Did you see this tweet about you?"

GSA offers online tutorials for government social media managers, through its DigitalGov University. One tutorial, "Minimize IT Security Risks While Using Social Media," helps agencies recognize spam and its role in the broader scope of IT management. GSA also issues periodic reports that provide specific guidance on responding to social media attacks.

For commercial enterprises, social spam also represents a growing financial cost, said Devin Redmond, co-founder and CEO of Nexgate, who calls it "a significant burden to big brands" and a drain on media marketing programs.

The fact that spammers can target entire online communities in a single post, and have that post distributed to others, makes it a greater threat than conventional email spam. Social spam is also becoming more complex.

Text- and link-based spam are the most popular types, while" Like-jacking," social bots, spammy apps and fake accounts are the most prevalent forms of distribution.

"Traditional email, Web and antivirus solutions just don't work in social media," a Nexgate spokesman said.

Comment  | 
Print  | 
More Insights
Comments
Threaded  |  Newest First  |  Oldest First
WKash
50%
50%
WKash,
User Rank: Apprentice
9/26/2013 | 8:48:48 PM
re: Social Spam Invades The Enterprise
On a side note, GSA's DigitalGov University is becoming a great resource for federal employees who aren't necessarily involved in their agencies social media campaigns.

Check out "Minimize IT Security Risks While Using Social Media," which helps agencies recognize spam.
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
Flash Poll
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2015-3308
Published: 2015-09-02
Double free vulnerability in lib/x509/x509_ext.c in GnuTLS before 3.3.14 allows remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted CRL distribution point.

CVE-2015-4330
Published: 2015-09-02
A local file script in Cisco TelePresence Video Communication Server (VCS) Expressway X8.5.2 allows local users to gain privileges for OS command execution via invalid parameters, aka Bug ID CSCuv10556.

CVE-2015-6274
Published: 2015-09-02
The IPv4 implementation on Cisco ASR 1000 devices with software 15.5(3)S allows remote attackers to cause a denial of service (ESP QFP CPU consumption) by triggering packet fragmentation and reassembly, aka Bug ID CSCuv71273.

CVE-2015-6277
Published: 2015-09-02
The ARP implementation in Cisco NX-OS on Nexus 1000V devices for VMware vSphere 5.2(1)SV3(1.4), Nexus 3000 devices 7.3(0)ZD(0.47), Nexus 4000 devices 4.1(2)E1, Nexus 9000 devices 7.3(0)ZD(0.61), and MDS 9000 devices 7.0(0)HSK(0.353) and SAN-OS NX-OS on MDS 9000 devices 7.0(0)HSK(0.353) allows remote...

CVE-2015-6587
Published: 2015-09-02
The vlserver in OpenAFS before 1.6.13 allows remote authenticated users to cause a denial of service (out-of-bounds read and crash) via a crafted regular expression in a VL_ListAttributesN2 RPC.

Dark Reading Radio
Archived Dark Reading Radio
Another Black Hat is in the books and Dark Reading was there. Join the editors as they share their top stories, biggest lessons, and best conversations from the premier security conference.