Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Vulnerabilities / Threats

8/19/2011
02:41 PM
Connect Directly
Google+
LinkedIn
Twitter
RSS
E-Mail
50%
50%

Facebook Offers Security Guide

Faceboook tries to explain the many security issues that have arisen for users of social networking and give tips for keeping accounts secure.

Top 15 Facebook Apps For Business
(click image for larger view)
Slideshow: Top 15 Facebook Apps For Business
Facebook on Thursday began promoting a guide designed to help users participate in its social network with less risk, a need that has grown as the service has.

Co-authored by Linda McCarthy, former senior director of Internet safety at Symantec, Keith Watson, a security research engineer at Purdue University, and Denise Weldon-Siviy, a teacher and editor, the Guide to Facebook Security offers both well-worn security advice and surprising recommendations.

Though some Facebook users question the wisdom of presenting the guide as a downloadable PDF--a common vector for malware--those averse to PDFs are probably sufficiently sensitized to Internet security issues that they wouldn't benefit from the advice. Those unaware of the potential pitfalls of file downloads, however, will almost certainly find something of value in the 14-page document.

The guide opens with the most common online security recommendation in recent years: choose a good password, one that's at least eight characters long, contains one or more numbers, and at least one special character. It goes on to reiterate other conventional wisdom, like not reusing your Facebook password on other sites, not sharing it with friends, and changing it regularly.

You've probably heard this before. But many Facebook users probably haven't or have ignored this advice previously, which is why it bears repeating.

What might not be expected is advice like making sure you log out of Facebook. "Logging out of Facebook when you're not using it is a simple and effective way to protect your account," the guide states. "Many people think that if they close the webpage or exit the browser that also logs them out of Facebook. It doesn't. The next person who goes to Facebook.com on that computer will find themselves [sic] already logged in--to your account."

Facebook has a vested interest in keeping users logged in: It could log users out after a period of inactivity, the way online banking sites do. But the company wants users to remain logged in when they visit other websites, particularly sites that have integrated Facebook APIs, like Social Plugins. That's because social features provided by Facebook won't load on third-party sites when a Facebook user visits but isn't logged in to Facebook.

The authors of the guide appear to be aware of this tension, because they qualify their advice. The guide specifies that you should log out of Facebook when using the service away from home. Even so, the guide also advises logging out of Facebook when a home computer is shared. Those serious about security might consider logging out at the conclusion of a Facebook session, even if that de-socializes third-party websites.

The guide also advises Facebook users to only friend people they know. Anyone with more than several hundred Facebook "friends" has probably violated this suggestion many times over.

This is particularly important because Facebook operates under the assumption that you know your friends. When attempting to access Facebook from abroad, Facebook will attempt to verify your identity by asking you to identify your friends in tagged pictures.

The security guide also provides valuable recommendations about things like how to obtain a one-time password--text "otp" to 32665 (FBOOK) from a phone that you've registered with Facebook--and how "Like" buttons can be trapped for clickjacking attacks.

If you're the least bit unsure about how to navigate the world of social networking securely, take a look at the Guide to Facebook Security.

Attend Enterprise 2.0 Santa Clara, Nov. 14-17, 2011, and learn how to drive business value with collaboration, with an emphasis on how real customers are using social software to enable more productive workforces and to be more responsive and engaged with customers and business partners. Register today and save 30% off conference passes, or get a free expo pass with priority code CPHCES02. Find out more and register.

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: Our Endpoint Protection system is a little outdated... 
Current Issue
The Year in Security: 2019
This Tech Digest provides a wrap up and overview of the year's top cybersecurity news stories. It was a year of new twists on old threats, with fears of another WannaCry-type worm and of a possible botnet army of Wi-Fi routers. But 2019 also underscored the risk of firmware and trusted security tools harboring dangerous holes that cybercriminals and nation-state hackers could readily abuse. Read more.
Flash Poll
Rethinking Enterprise Data Defense
Rethinking Enterprise Data Defense
Frustrated with recurring intrusions and breaches, cybersecurity professionals are questioning some of the industrys conventional wisdom. Heres a look at what theyre thinking about.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-10694
PUBLISHED: 2019-12-12
The express install, which is the suggested way to install Puppet Enterprise, gives the user a URL at the end of the install to set the admin password. If they do not use that URL, there is an overlooked default password for the admin user. This was resolved in Puppet Enterprise 2019.0.3 and 2018.1....
CVE-2019-10695
PUBLISHED: 2019-12-12
When using the cd4pe::root_configuration task to configure a Continuous Delivery for PE installation, the root user�s username and password were exposed in the job�s Job Details pane in the PE console. These issues have been resolved in version 1.2.1 of the ...
CVE-2019-5085
PUBLISHED: 2019-12-12
An exploitable code execution vulnerability exists in the DICOM packet-parsing functionality of LEADTOOLS libltdic.so, version 20.0.2019.3.15. A specially crafted packet can cause an integer overflow, resulting in heap corruption. An attacker can send a packet to trigger this vulnerability.
CVE-2019-5090
PUBLISHED: 2019-12-12
An exploitable information disclosure vulnerability exists in the DICOM packet-parsing functionality of LEADTOOLS libltdic.so, version 20.0.2019.3.15. A specially crafted packet can cause an out-of-bounds read, resulting in information disclosure. An attacker can send a packet to trigger this vulner...
CVE-2019-5091
PUBLISHED: 2019-12-12
An exploitable denial-of-service vulnerability exists in the Dicom-packet parsing functionality of LEADTOOLS libltdic.so version 20.0.2019.3.15. A specially crafted packet can cause an infinite loop, resulting in a denial of service. An attacker can send a packet to trigger this vulnerability.