Misplaced trust on the social networking site opens the door for phishers and scammers, and mobile devices could be their next malware distribution channel.
Facebook is the new front line in the war on malware, as evidenced by the increasing number and virulence of attacks, notably the fake Osama bin Laden death video scam in early May.
Why Facebook? Because in the never-ending game of malware whack-a-mole, as soon as the security industry develops, and end users adopt, effective tools for blocking a particular mode of propagation, whether it's infected attachments in email spam or bogus links on a spoofed Web site, malicious attackers migrate to another delivery vehicle. With modern antivirus software and network intrusion-protection systems incorporating multiple scanning and blocking techniques, including cloud-based site and application reputation statistics (like these from Cisco, McAfee, Virus Total, and Web of Trust), and as users have become cautious about clicking through on unsolicited messages, it's harder than ever for malware perpetrators to hide behind an authentic-sounding impostor URL (like bigbankaccount.com) or an obfuscated IP address.
So, where might potential malware victims still have their guard down and be susceptible to a phishing scam? Facebook, of course, since these are messages from their "friends," after all.
This has a lot to do with mobile security, since, according to Facebook, half of its 500 million frequent users are on mobile devices, and they're twice as active as nonmobile users. So, where email was the preferred PC-era malware 1.0 vector, Facebook could turn into the most effective mobile-device malware 2.0 distribution channel. As University of California, Riverside, security researcher Md Sazzadur Rahman puts it, "Facebook is the new Web. It provides a fertile ground to spread malware, since users trust links and posts seemingly from their friends. Hackers have realized this and have started using it to distribute malware and conduct identity theft."
In response, Rahman and his UC Riverside colleague Ting-Kai Huang have developed a Facebook application, MyPageKeeper, that detects spam and malware posted on users' walls and news feeds. Once installed, the native Facebook app acts much like a Web content scanner, continuously monitoring wall posts, news feeds, and links posted by friends, looking for malware, spam, or other suspicious material. Users are notified via Facebook mail, and the app can automatically generate comments flagging malicious posts.
MyPageKeeper follows on the heels of a similar Facebook security app, Safego (installable here), from security software vendor BitDefender. It too performs background URL scanning, automatically posting warning comments on suspicious entries, but goes one step further by scanning your Facebook profile looking for excessively permissive settings that could expose sensitive information to people outside your social circle (i.e. spear-phishing trollers).
Facebook is the second-largest Internet destination (behind the omnipresent Google), and, although there are signs its growth is slowing in the U.S., it remains the most significant online "walled garden" and is thus a target-rich environment for phishers, scammers, and other cyberthieves. So far, the exploits are directed at PCs, but the growing use of mobile devices, particularly iOS and Android phones and tablets, means they won't avoid the malware plague for long.
Aside from investigating these new Facebook security apps, IT should encourage users to improve their Facebook hygiene. A good starting point is Facebook itself, which has a site filled with security tips. The best starting point is scrubbing your profile and privacy settings and always being skeptical about whom you accept as a friend. Just as no one would invite some random passer-by into the home to browse through photo albums or listen in on phone conversations, neither should anyone consent to giving some smooth-talking online interloper the same access to your virtual identity by making that person a Facebook friend.
InformationWeek Elite 100Our data shows these innovators using digital technology in two key areas: providing better products and cutting costs. Almost half of them expect to introduce a new IT-led product this year, and 46% are using technology to make business processes more efficient.
The UC Infrastructure TrapWorries about subpar networks tanking unified communications programs could be valid: Thirty-one percent of respondents have rolled capabilities out to less than 10% of users vs. 21% delivering UC to 76% or more. Is low uptake a result of strained infrastructures delivering poor performance?
Join us for a roundup of the top stories on InformationWeek.com for the week of December 14, 2014. Be here for the show and for the incredible Friday Afternoon Conversation that runs beside the program.