Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Vulnerabilities / Threats

8/19/2011
02:41 PM
Connect Directly
LinkedIn
Twitter
RSS
E-Mail
50%
50%

Facebook Offers Security Guide

Faceboook tries to explain the many security issues that have arisen for users of social networking and give tips for keeping accounts secure.

Top 15 Facebook Apps For Business
(click image for larger view)
Slideshow: Top 15 Facebook Apps For Business
Facebook on Thursday began promoting a guide designed to help users participate in its social network with less risk, a need that has grown as the service has.

Co-authored by Linda McCarthy, former senior director of Internet safety at Symantec, Keith Watson, a security research engineer at Purdue University, and Denise Weldon-Siviy, a teacher and editor, the Guide to Facebook Security offers both well-worn security advice and surprising recommendations.

Though some Facebook users question the wisdom of presenting the guide as a downloadable PDF--a common vector for malware--those averse to PDFs are probably sufficiently sensitized to Internet security issues that they wouldn't benefit from the advice. Those unaware of the potential pitfalls of file downloads, however, will almost certainly find something of value in the 14-page document.

The guide opens with the most common online security recommendation in recent years: choose a good password, one that's at least eight characters long, contains one or more numbers, and at least one special character. It goes on to reiterate other conventional wisdom, like not reusing your Facebook password on other sites, not sharing it with friends, and changing it regularly.

You've probably heard this before. But many Facebook users probably haven't or have ignored this advice previously, which is why it bears repeating.

What might not be expected is advice like making sure you log out of Facebook. "Logging out of Facebook when you're not using it is a simple and effective way to protect your account," the guide states. "Many people think that if they close the webpage or exit the browser that also logs them out of Facebook. It doesn't. The next person who goes to Facebook.com on that computer will find themselves [sic] already logged in--to your account."

Facebook has a vested interest in keeping users logged in: It could log users out after a period of inactivity, the way online banking sites do. But the company wants users to remain logged in when they visit other websites, particularly sites that have integrated Facebook APIs, like Social Plugins. That's because social features provided by Facebook won't load on third-party sites when a Facebook user visits but isn't logged in to Facebook.

The authors of the guide appear to be aware of this tension, because they qualify their advice. The guide specifies that you should log out of Facebook when using the service away from home. Even so, the guide also advises logging out of Facebook when a home computer is shared. Those serious about security might consider logging out at the conclusion of a Facebook session, even if that de-socializes third-party websites.

The guide also advises Facebook users to only friend people they know. Anyone with more than several hundred Facebook "friends" has probably violated this suggestion many times over.

This is particularly important because Facebook operates under the assumption that you know your friends. When attempting to access Facebook from abroad, Facebook will attempt to verify your identity by asking you to identify your friends in tagged pictures.

The security guide also provides valuable recommendations about things like how to obtain a one-time password--text "otp" to 32665 (FBOOK) from a phone that you've registered with Facebook--and how "Like" buttons can be trapped for clickjacking attacks.

If you're the least bit unsure about how to navigate the world of social networking securely, take a look at the Guide to Facebook Security.

Attend Enterprise 2.0 Santa Clara, Nov. 14-17, 2011, and learn how to drive business value with collaboration, with an emphasis on how real customers are using social software to enable more productive workforces and to be more responsive and engaged with customers and business partners. Register today and save 30% off conference passes, or get a free expo pass with priority code CPHCES02. Find out more and register.

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Commentary
Ransomware Is Not the Problem
Adam Shostack, Consultant, Entrepreneur, Technologist, Game Designer,  6/9/2021
Edge-DRsplash-11-edge-ask-the-experts
How Can I Test the Security of My Home-Office Employees' Routers?
John Bock, Senior Research Scientist,  6/7/2021
News
New Ransomware Group Claiming Connection to REvil Gang Surfaces
Jai Vijayan, Contributing Writer,  6/10/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win an Amazon Gift Card! Click Here
Latest Comment: Zero Trust doesn't have to break your budget!
Current Issue
The State of Cybersecurity Incident Response
In this report learn how enterprises are building their incident response teams and processes, how they research potential compromises, how they respond to new breaches, and what tools and processes they use to remediate problems and improve their cyber defenses for the future.
Flash Poll
How Enterprises are Developing Secure Applications
How Enterprises are Developing Secure Applications
Recent breaches of third-party apps are driving many organizations to think harder about the security of their off-the-shelf software as they continue to move left in secure software development practices.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-25414
PUBLISHED: 2021-06-17
A local file inclusion vulnerability was discovered in the captcha function in Monstra 3.0.4 which allows remote attackers to execute arbitrary PHP code.
CVE-2021-32078
PUBLISHED: 2021-06-17
An Out-of-Bounds Read was discovered in arch/arm/mach-footbridge/personal-pci.c in the Linux kernel through 5.12.11 because of the lack of a check for a value that shouldn't be negative, e.g., access to element -2 of an array, aka CID-298a58e165e4.
CVE-2021-31818
PUBLISHED: 2021-06-17
Affected versions of Octopus Server are prone to an authenticated SQL injection vulnerability in the Events REST API because user supplied data in the API request isn’t parameterised correctly. Exploiting this vulnerability could allow unauthorised access to database tables.
CVE-2021-34825
PUBLISHED: 2021-06-17
Quassel through 0.13.1, when --require-ssl is enabled, launches without SSL or TLS support if a usable X.509 certificate is not found on the local system.
CVE-2021-32944
PUBLISHED: 2021-06-17
A use-after-free issue exists in the DGN file-reading procedure in the Drawings SDK (All versions prior to 2022.4) resulting from the lack of proper validation of user-supplied data. This can result in a memory corruption or arbitrary code execution, allowing attackers to cause a denial-of-service c...