Facebook, The New Malware Vector

Facebook is the new front line in the war on malware, as evidenced by the increasing number and virulence of attacks, notably the fake Osama bin Laden death video scam in early May.

Why Facebook? Because in the never-ending game of malware whack-a-mole, as soon as the security industry develops, and end users adopt, effective tools for blocking a particular mode of propagation, whether it's infected attachments in email spam or bogus links on a spoofed Web site, malicious attackers migrate to another delivery vehicle. With modern antivirus software and network intrusion-protection systems incorporating multiple scanning and blocking techniques, including cloud-based site and application reputation statistics (like these from Cisco, McAfee, Virus Total, and Web of Trust), and as users have become cautious about clicking through on unsolicited messages, it's harder than ever for malware perpetrators to hide behind an authentic-sounding impostor URL (like bigbankaccount.com) or an obfuscated IP address.

So, where might potential malware victims still have their guard down and be susceptible to a phishing scam? Facebook, of course, since these are messages from their "friends," after all.

This has a lot to do with mobile security, since, according to Facebook, half of its 500 million frequent users are on mobile devices, and they're twice as active as nonmobile users. So, where email was the preferred PC-era malware 1.0 vector, Facebook could turn into the most effective mobile-device malware 2.0 distribution channel. As University of California, Riverside, security researcher Md Sazzadur Rahman puts it, "Facebook is the new Web. It provides a fertile ground to spread malware, since users trust links and posts seemingly from their friends. Hackers have realized this and have started using it to distribute malware and conduct identity theft."

In response, Rahman and his UC Riverside colleague Ting-Kai Huang have developed a Facebook application, MyPageKeeper, that detects spam and malware posted on users' walls and news feeds. Once installed, the native Facebook app acts much like a Web content scanner, continuously monitoring wall posts, news feeds, and links posted by friends, looking for malware, spam, or other suspicious material. Users are notified via Facebook mail, and the app can automatically generate comments flagging malicious posts.

MyPageKeeper follows on the heels of a similar Facebook security app, Safego (installable here), from security software vendor BitDefender. It too performs background URL scanning, automatically posting warning comments on suspicious entries, but goes one step further by scanning your Facebook profile looking for excessively permissive settings that could expose sensitive information to people outside your social circle (i.e. spear-phishing trollers).

Facebook is the second-largest Internet destination (behind the omnipresent Google), and, although there are signs its growth is slowing in the U.S., it remains the most significant online "walled garden" and is thus a target-rich environment for phishers, scammers, and other cyberthieves. So far, the exploits are directed at PCs, but the growing use of mobile devices, particularly iOS and Android phones and tablets, means they won't avoid the malware plague for long.

Aside from investigating these new Facebook security apps, IT should encourage users to improve their Facebook hygiene. A good starting point is Facebook itself, which has a site filled with security tips. The best starting point is scrubbing your profile and privacy settings and always being skeptical about whom you accept as a friend. Just as no one would invite some random passer-by into the home to browse through photo albums or listen in on phone conversations, neither should anyone consent to giving some smooth-talking online interloper the same access to your virtual identity by making that person a Facebook friend.