News Application Security
The Seven Deadliest Social Networking Hacks
Think you know who your real online friends are? You could be just a few hops away from a cybercriminal in today's social networks
It started with a stolen Facebook photo attached to an inflammatory profile. It led to online harassment, death threats, and emails to the victims boss questioning the victims character. But an online personal attack against Graham Cluley earlier this year is one example of how easy it is to use a social network to damage the identity of an individual -- or an entire company.
More Security Insights
- Accelerating Economic Growth and Vitality through Smarter Public Safety Management
- Digital Transformation: Creating new business models where digital meets physical
- Get Actionable Insight with Security Intelligence for Mainframe Environments
- Technical Debt: Asset or Liability
Cluleys case shows just how rapidly social networks can spread a smear campaign or personal attack -- and how it can quickly spread to the victims professional life. Cluley, who is a senior technology consultant with Sophos, recently met another victim who experienced a similar attack on Facebook, Kerry Harvey. He says it was apparently an acquaintance of Harveys who built a phony Kerry Harvey Facebook profile that branded her occupation as a prostitute, complete with her cellphone number. (See ID Theft Victim Branded a 'Prostitute' .)
Could such a thing happen to you or employees at your company? You bet. Social networks are the next major attack venue for trolls, spammers, bot herders, cybercriminals, corporate spies -- and even jilted ex-lovers or enemies -- to make money, or just plain wreak havoc on their victims personal lives, security experts say.
It's the easiest way to passively gain intelligence on the largest groups of society and nearly every walk of life, says Robert Hansen, aka RSnake, founder of SecTheory LLC.
The root of the problem is that social networking sites by nature aren't secure. They typically dont authenticate new members -- you cant always be sure that your online friend is who she says she is -- and attackers can easily exploit and capitalize on the trusted culture within the social network. Users often don't deploy the security and privacy options that some of these sites offer, either.
Social networking application development tools like OpenSocial and third-party tools on Facebook, for example, can be abused by attackers to readily spread malware or lift personal information. Theres also the very real risk of corporate espionage, with attackers culling tidbits from personal or professional social net profiles to wage targeted attacks on businesses via their employees. And popular Web attacks, like cross-site scripting, can also be used against members of social networks.
And dont think for a minute that your private or closed profile keeps you safe from an attack or potential personal embarrassment, either. There is no such thing as privacy on the Internet, says Adam ODonnell, director of emerging technologies for Cloudmark. You are only delaying the inevitable information leakage for any content you put online. My recommendation is to treat the Internet as if all content there lasts forever.
Attacks on social networking sites have only just begun, so think twice before you get too personal with what you post on them, or too loose about accepting and trusting new friends and connections.
Youre only going to see these attacks on social networks go up, says researcher Nathan Hamiel, who along with colleague Shawn Moyer recently conducted some relatively simple but scary hacks recently on various social networks that they demonstrated at Black Hat USA and Defcon 16 this month. Weve noticed some weird social networking attacks since we did our talk at those hacker conferences, he says.
Here's a look at the seven most lethal social networks hacks:
- 1) Impersonation and targeted personal attacks
- 2) Spam and bot infections
- 3) Weaponized OpenSocial and other social networking applications
- 4) Crossover of personal to professional online presence
- 5) XSS, CSRF attacks
- 6) Identity theft
- 7) Corporate espionage
Next Page: 1) Impersonation and targeted personal attacks