Risk
9/25/2013
01:28 PM
Connect Directly
LinkedIn
Twitter
RSS
E-Mail
50%
50%
Repost This

Social Spam Invades The Enterprise

Spammers increasingly dodge email spam tools by using social media, posing new risks to government and corporate enterprises, study says.

Top 10 Government IT Innovators Of 2013
Top 10 Government IT Innovators Of 2013
(click image for larger view)
Social media hasn't yet displaced email for day-to-day office communications, but it has taken on one of email's most pervasive and onerous qualities: relentless spam.

Spammers are using social media to circumvent conventional security methods that provided at least some ability to detect and quarantine unwanted email.

Just how much spam is pouring in through social media is presented in a new report on social spam from Nexgate, which has a stake in social media security.

Nexgate data scientists analyzed more than 60 million pieces of unique social content published on more than 25 million social accounts, and concluded:

-- During the first six months of 2013 there was a 355% growth of social spam.

[ Read how Google got in trouble for partnering with a texting service. Google Settles Text Spam Suit For $6 Million. ]

-- 15% of all social spam contains a URL, often to spammy content, pornography or malware.

-- One in 21 social media messages across Facebook, YouTube, Google+ and Twitter contains risky content, such as adult language, private or regulated data, or spam.

-- One in 200 social media messages contain spam, including lures to adult content and malware.

-- Facebook contains the highest number of phishing attempts and personally identifiable information; in fact, more than four times the other social media networks.

-- YouTube contains the most "risky" content -- containing profanity, threats, hate speech or insults. For every one piece of risky content found on other social media networks, there are five pieces on YouTube.

The rise of social media spam is creating a new set of issues not only for corporate and government social media managers, but also their IT security teams.

"Spam isn't just an annoyance issue for federal employees," said Justin Herman, social media lead for the General Services Administration, which helps federal agencies develop their public-facing social media strategies. "It can also be a security issue if used maliciously."

The GSA's Office of Citizen Services and Innovative Technologies, where Herman works, is already guiding and training agencies on how to handle social spam messages "as part of our larger social media management and security programs," he said. He warns users, for instance, to guard against social media posts that offer a link and read: "Did you see this tweet about you?"

GSA offers online tutorials for government social media managers, through its DigitalGov University. One tutorial, "Minimize IT Security Risks While Using Social Media," helps agencies recognize spam and its role in the broader scope of IT management. GSA also issues periodic reports that provide specific guidance on responding to social media attacks.

For commercial enterprises, social spam also represents a growing financial cost, said Devin Redmond, co-founder and CEO of Nexgate, who calls it "a significant burden to big brands" and a drain on media marketing programs.

The fact that spammers can target entire online communities in a single post, and have that post distributed to others, makes it a greater threat than conventional email spam. Social spam is also becoming more complex.

Text- and link-based spam are the most popular types, while" Like-jacking," social bots, spammy apps and fake accounts are the most prevalent forms of distribution.

"Traditional email, Web and antivirus solutions just don't work in social media," a Nexgate spokesman said.

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
WKash
50%
50%
WKash,
User Rank: Apprentice
9/26/2013 | 8:48:48 PM
re: Social Spam Invades The Enterprise
On a side note, GSA's DigitalGov University is becoming a great resource for federal employees who aren't necessarily involved in their agencies social media campaigns.

Check out "Minimize IT Security Risks While Using Social Media," which helps agencies recognize spam.
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2012-3946
Published: 2014-04-24
Cisco IOS before 15.3(2)S allows remote attackers to bypass interface ACL restrictions in opportunistic circumstances by sending IPv6 packets in an unspecified scenario in which expected packet drops do not occur for "a small percentage" of the packets, aka Bug ID CSCty73682.

CVE-2012-5723
Published: 2014-04-24
Cisco ASR 1000 devices with software before 3.8S, when BDI routing is enabled, allow remote attackers to cause a denial of service (device reload) via crafted (1) broadcast or (2) multicast ICMP packets with fragmentation, aka Bug ID CSCub55948.

CVE-2013-6738
Published: 2014-04-24
Cross-site scripting (XSS) vulnerability in IBM SmartCloud Analytics Log Analysis 1.1 and 1.2 before 1.2.0.0-CSI-SCALA-IF0003 allows remote attackers to inject arbitrary web script or HTML via an invalid query parameter in a response from an OAuth authorization endpoint.

CVE-2014-2391
Published: 2014-04-24
The password recovery service in Open-Xchange AppSuite before 7.2.2-rev20, 7.4.1 before 7.4.1-rev11, and 7.4.2 before 7.4.2-rev13 makes an improper decision about the sensitivity of a string representing a previously used but currently invalid password, which allows remote attackers to obtain potent...

CVE-2014-2392
Published: 2014-04-24
The E-Mail autoconfiguration feature in Open-Xchange AppSuite before 7.2.2-rev20, 7.4.1 before 7.4.1-rev11, and 7.4.2 before 7.4.2-rev13 places a password in a GET request, which allows remote attackers to obtain sensitive information by reading (1) web-server access logs, (2) web-server Referer log...

Best of the Web