Risk
9/25/2013
01:28 PM
50%
50%

Social Spam Invades The Enterprise

Spammers increasingly dodge email spam tools by using social media, posing new risks to government and corporate enterprises, study says.

Top 10 Government IT Innovators Of 2013
Top 10 Government IT Innovators Of 2013
(click image for larger view)
Social media hasn't yet displaced email for day-to-day office communications, but it has taken on one of email's most pervasive and onerous qualities: relentless spam.

Spammers are using social media to circumvent conventional security methods that provided at least some ability to detect and quarantine unwanted email.

Just how much spam is pouring in through social media is presented in a new report on social spam from Nexgate, which has a stake in social media security.

Nexgate data scientists analyzed more than 60 million pieces of unique social content published on more than 25 million social accounts, and concluded:

-- During the first six months of 2013 there was a 355% growth of social spam.

[ Read how Google got in trouble for partnering with a texting service. Google Settles Text Spam Suit For $6 Million. ]

-- 15% of all social spam contains a URL, often to spammy content, pornography or malware.

-- One in 21 social media messages across Facebook, YouTube, Google+ and Twitter contains risky content, such as adult language, private or regulated data, or spam.

-- One in 200 social media messages contain spam, including lures to adult content and malware.

-- Facebook contains the highest number of phishing attempts and personally identifiable information; in fact, more than four times the other social media networks.

-- YouTube contains the most "risky" content -- containing profanity, threats, hate speech or insults. For every one piece of risky content found on other social media networks, there are five pieces on YouTube.

The rise of social media spam is creating a new set of issues not only for corporate and government social media managers, but also their IT security teams.

"Spam isn't just an annoyance issue for federal employees," said Justin Herman, social media lead for the General Services Administration, which helps federal agencies develop their public-facing social media strategies. "It can also be a security issue if used maliciously."

The GSA's Office of Citizen Services and Innovative Technologies, where Herman works, is already guiding and training agencies on how to handle social spam messages "as part of our larger social media management and security programs," he said. He warns users, for instance, to guard against social media posts that offer a link and read: "Did you see this tweet about you?"

GSA offers online tutorials for government social media managers, through its DigitalGov University. One tutorial, "Minimize IT Security Risks While Using Social Media," helps agencies recognize spam and its role in the broader scope of IT management. GSA also issues periodic reports that provide specific guidance on responding to social media attacks.

For commercial enterprises, social spam also represents a growing financial cost, said Devin Redmond, co-founder and CEO of Nexgate, who calls it "a significant burden to big brands" and a drain on media marketing programs.

The fact that spammers can target entire online communities in a single post, and have that post distributed to others, makes it a greater threat than conventional email spam. Social spam is also becoming more complex.

Text- and link-based spam are the most popular types, while" Like-jacking," social bots, spammy apps and fake accounts are the most prevalent forms of distribution.

"Traditional email, Web and antivirus solutions just don't work in social media," a Nexgate spokesman said.

Comment  | 
Print  | 
More Insights
Comments
Threaded  |  Newest First  |  Oldest First
WKash
50%
50%
WKash,
User Rank: Apprentice
9/26/2013 | 8:48:48 PM
re: Social Spam Invades The Enterprise
On a side note, GSA's DigitalGov University is becoming a great resource for federal employees who aren't necessarily involved in their agencies social media campaigns.

Check out "Minimize IT Security Risks While Using Social Media," which helps agencies recognize spam.
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Dark Reading, January 2015
To find and fix exploits aimed directly at your business, stop waiting for alerts and become a proactive hunter.
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2013-7402
Published: 2014-12-17
Multiple unspecified vulnerabilities in request.c in c-icap 0.2.x allow remote attackers to cause a denial of service (crash) via a crafted ICAP request.

CVE-2014-5437
Published: 2014-12-17
Multiple cross-site request forgery (CSRF) vulnerabilities in ARRIS Touchstone TG862G/CT Telephony Gateway with firmware 7.6.59S.CT and earlier allow remote attackers to hijack the authentication of administrators for requests that (1) enable remote management via a request to remote_management.php,...

CVE-2014-5438
Published: 2014-12-17
Cross-site scripting (XSS) vulnerability in ARRIS Touchstone TG862G/CT Telephony Gateway with firmware 7.6.59S.CT and earlier allows remote authenticated users to inject arbitrary web script or HTML via the computer_name parameter to connected_devices_computers_edit.php.

CVE-2014-7170
Published: 2014-12-17
Race condition in Puppet Server 0.2.0 allows local users to obtain sensitive information by accessing it in between package installation or upgrade and the start of the service.

CVE-2014-7285
Published: 2014-12-17
The management console on the Symantec Web Gateway (SWG) appliance before 5.2.2 allows remote authenticated users to execute arbitrary OS commands by injecting command strings into unspecified PHP scripts.

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
Join us Wednesday, Dec. 17 at 1 p.m. Eastern Time to hear what employers are really looking for in a chief information security officer -- it may not be what you think.