Risk
9/25/2013
01:28 PM
Connect Directly
RSS
E-Mail
50%
50%

Social Spam Invades The Enterprise

Spammers increasingly dodge email spam tools by using social media, posing new risks to government and corporate enterprises, study says.

Top 10 Government IT Innovators Of 2013
Top 10 Government IT Innovators Of 2013
(click image for larger view)
Social media hasn't yet displaced email for day-to-day office communications, but it has taken on one of email's most pervasive and onerous qualities: relentless spam.

Spammers are using social media to circumvent conventional security methods that provided at least some ability to detect and quarantine unwanted email.

Just how much spam is pouring in through social media is presented in a new report on social spam from Nexgate, which has a stake in social media security.

Nexgate data scientists analyzed more than 60 million pieces of unique social content published on more than 25 million social accounts, and concluded:

-- During the first six months of 2013 there was a 355% growth of social spam.

[ Read how Google got in trouble for partnering with a texting service. Google Settles Text Spam Suit For $6 Million. ]

-- 15% of all social spam contains a URL, often to spammy content, pornography or malware.

-- One in 21 social media messages across Facebook, YouTube, Google+ and Twitter contains risky content, such as adult language, private or regulated data, or spam.

-- One in 200 social media messages contain spam, including lures to adult content and malware.

-- Facebook contains the highest number of phishing attempts and personally identifiable information; in fact, more than four times the other social media networks.

-- YouTube contains the most "risky" content -- containing profanity, threats, hate speech or insults. For every one piece of risky content found on other social media networks, there are five pieces on YouTube.

The rise of social media spam is creating a new set of issues not only for corporate and government social media managers, but also their IT security teams.

"Spam isn't just an annoyance issue for federal employees," said Justin Herman, social media lead for the General Services Administration, which helps federal agencies develop their public-facing social media strategies. "It can also be a security issue if used maliciously."

The GSA's Office of Citizen Services and Innovative Technologies, where Herman works, is already guiding and training agencies on how to handle social spam messages "as part of our larger social media management and security programs," he said. He warns users, for instance, to guard against social media posts that offer a link and read: "Did you see this tweet about you?"

GSA offers online tutorials for government social media managers, through its DigitalGov University. One tutorial, "Minimize IT Security Risks While Using Social Media," helps agencies recognize spam and its role in the broader scope of IT management. GSA also issues periodic reports that provide specific guidance on responding to social media attacks.

For commercial enterprises, social spam also represents a growing financial cost, said Devin Redmond, co-founder and CEO of Nexgate, who calls it "a significant burden to big brands" and a drain on media marketing programs.

The fact that spammers can target entire online communities in a single post, and have that post distributed to others, makes it a greater threat than conventional email spam. Social spam is also becoming more complex.

Text- and link-based spam are the most popular types, while" Like-jacking," social bots, spammy apps and fake accounts are the most prevalent forms of distribution.

"Traditional email, Web and antivirus solutions just don't work in social media," a Nexgate spokesman said.

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
WKash
50%
50%
WKash,
User Rank: Apprentice
9/26/2013 | 8:48:48 PM
re: Social Spam Invades The Enterprise
On a side note, GSA's DigitalGov University is becoming a great resource for federal employees who aren't necessarily involved in their agencies social media campaigns.

Check out "Minimize IT Security Risks While Using Social Media," which helps agencies recognize spam.
Register for Dark Reading Newsletters
White Papers
Flash Poll
Current Issue
Cartoon
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2013-6306
Published: 2014-08-22
Unspecified vulnerability on IBM Power 7 Systems 740 before 740.70 01Ax740_121, 760 before 760.40 Ax760_078, and 770 before 770.30 01Ax770_062 allows local users to gain Service Processor privileges via unknown vectors.

CVE-2014-0232
Published: 2014-08-22
Multiple cross-site scripting (XSS) vulnerabilities in framework/common/webcommon/includes/messages.ftl in Apache OFBiz 11.04.01 before 11.04.05 and 12.04.01 before 12.04.04 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors, which are not properly handled in a (1)...

CVE-2014-3525
Published: 2014-08-22
Unspecified vulnerability in Apache Traffic Server 4.2.1.1 and 5.x before 5.0.1 has unknown impact and attack vectors, possibly related to health checks.

CVE-2014-3563
Published: 2014-08-22
Multiple unspecified vulnerabilities in Salt (aka SaltStack) before 2014.1.10 allow local users to have an unspecified impact via vectors related to temporary file creation in (1) seed.py, (2) salt-ssh, or (3) salt-cloud.

CVE-2014-3587
Published: 2014-08-22
Integer overflow in the cdf_read_property_info function in cdf.c in file through 5.19, as used in the Fileinfo component in PHP before 5.4.32 and 5.5.x before 5.5.16, allows remote attackers to cause a denial of service (application crash) via a crafted CDF file. NOTE: this vulnerability exists bec...

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
Three interviews on critical embedded systems and security, recorded at Black Hat 2014 in Las Vegas.