Cyber-crooks targeting social-networking websites

Mar 03, 2009 by Glenn Chapman
Computer security specialists warn that Facebook users have been hit with a series of data-stealing attacks in the past week as cyber crooks increasingly stalk social-networking websites. Facebook has become prime hunting ground for tricksters and malicious software spreaders because it is the leading social-networking community, with more than 175 million people sharing personal information.

Computer security specialists warn that Facebook users have been hit with a series of data-stealing attacks in the past week as cyber crooks increasingly stalk social-networking websites.

Facebook has become prime hunting ground for tricksters and malicious software spreaders because it is the leading social-networking community, with more than 175 million people sharing personal information.

"There are so many people on social-networking sites it is becoming profitable for bad guys to go there," said David Perry, global director of education at software security firm Trend Micro.

"Bad guys can see all the things you post. You may be revealing personal information that is extremely valuable."

Even seemingly innocent information posted on profile pages can sometimes provide opportunities for criminals.

For example, names of grandparents or pets in posted pictures can tip hackers off to answers for typical challenge questions asked before providing information about "forgotten passwords" to online accounts.

Hackers can try to infect software used at social-networking websites with malicious code as well as dupe people in the trust-based communities with fake messages and rigged mini-applications.

Facebook soared in popularity after it began letting outside developers craft mini-applications that people customize profile pages with hip, fun or functional features.

Facebook only vets mini-applications after they are released and someone complains.

"We have a rogue application that happened this weekend," said Trend Micro research manager Jamz Yaneza on Monday. "It was an application that got through security at Facebook. Kudos to Facebook for shutting it down real quick."

The application seemed to be a variation of one unleashed on Facebook users last week, according to Trend Micro.

Applications installed by Facebook users sent messages to their friends warning that the website was shutting down or that they had been reported for violating terms of service.

If people followed instructions in the bogus messages, software was installed on their computers that stole information and sent similar bogus messages to their friends on the site.

The most recent Facebook attack came in the form of messages claiming to be from friends that wanted to share digital video of the receivers.

Clicking on the link results in a prompt to download viewing software that is actually a computer worm called Koobface, a variation on the spelling of Facebook.

"It steals your cookie on your desktop; not just for Facebook but for a half-dozen social networking websites including MySpace," Yaneza said.

"Your account is compromised at that point. Using the hijacked cookie it tries to log in as you, goes through your address book and starts posting messages and comments."

Internet services routinely install small bits of software, called "cookies," on users' computers to store identifying information that can include user names and passwords.

Facebook and other social-networking websites that let outside developers customize Web-2.0 style widgets for users need to beef-up vetting processes to guard against "rogue developers," according to Yaneza.

He cited the stringent vetting process that Apple puts developers through before making third-party applications available at iTunes for iPhones and iPod Touch devices.

People can reduce the odds of becoming victims by being selective about friends at social networking websites and not clicking on links that take them outside the walls of their online communities.

Computer users are also wise to use unique complex passwords for each online account so if hackers get hold of one virtual key it won't open other locks, according to Yaneza.

(c) 2009 AFP

Explore further: 'Map spam' puts Google in awkward place

Related Stories

United States, China team explore energy harvesting

6 hours ago

Six authors have described their work in harvesting energy in a paper titled "Ultrathin, Rollable, Paper-Based Triboelectric Nanogenerator for Acoustic Energy Harvesting and Self-Powered Sound Recording." ...

China's struggle for water security

7 hours ago

Way back in 1999, before he became China's prime minister, Wen Jiabao warned that water scarcity posed one of the greatest threats to the "survival of the nation".

Canada revises upward CO2 emission data since 1990

7 hours ago

Canada revised its greenhouse gas emission data from 1990 to 2013 in a report Friday, showing it had higher carbon dioxide discharges each year, and a doubling of emissions from its oil sands.

Recommended for you

'Map spam' puts Google in awkward place

1 hour ago

Google was re-evaluating its user-edited online map system Friday after the latest embarrassing incident—an image of an Android mascot urinating on an Apple logo.

Google search mobile switch a revolution for some

17 hours ago

Google's latest Internet revolution this week saw the web giant modify its search algorithm to favour mobile-friendly sites, in a bid to upstage Apple that US media branded a "mobilegeddon".

Cheap content, growing reach make Snapchat a fast-rising star

Apr 22, 2015

Thousands of revelers descended on the Coachella music festival this month to rock out to their favorite bands and party day and night. But a far bigger audience from around the world - at least 40 million - joined in remotely ...

User comments : 0

Please sign in to add a comment. Registration is free, and takes less than a minute. Read more

Click here to reset your password.
Sign in to get notified via email when new comments are made.