Cyber-crooks targeting social-networking websites

March 3, 2009 by Glenn Chapman
Computer security specialists warn that Facebook users have been hit with a series of data-stealing attacks in the past week as cyber crooks increasingly stalk social-networking websites. Facebook has become prime hunting ground for tricksters and malicious software spreaders because it is the leading social-networking community, with more than 175 million people sharing personal information.

Computer security specialists warn that Facebook users have been hit with a series of data-stealing attacks in the past week as cyber crooks increasingly stalk social-networking websites.

Facebook has become prime hunting ground for tricksters and malicious software spreaders because it is the leading social-networking community, with more than 175 million people sharing personal information.

"There are so many people on social-networking sites it is becoming profitable for bad guys to go there," said David Perry, global director of education at software security firm Trend Micro.

"Bad guys can see all the things you post. You may be revealing personal information that is extremely valuable."

Even seemingly innocent information posted on profile pages can sometimes provide opportunities for criminals.

For example, names of grandparents or pets in posted pictures can tip hackers off to answers for typical challenge questions asked before providing information about "forgotten passwords" to online accounts.

Hackers can try to infect software used at social-networking websites with malicious code as well as dupe people in the trust-based communities with fake messages and rigged mini-applications.

Facebook soared in popularity after it began letting outside developers craft mini-applications that people customize profile pages with hip, fun or functional features.

Facebook only vets mini-applications after they are released and someone complains.

"We have a rogue application that happened this weekend," said Trend Micro research manager Jamz Yaneza on Monday. "It was an application that got through security at Facebook. Kudos to Facebook for shutting it down real quick."

The application seemed to be a variation of one unleashed on Facebook users last week, according to Trend Micro.

Applications installed by Facebook users sent messages to their friends warning that the website was shutting down or that they had been reported for violating terms of service.

If people followed instructions in the bogus messages, software was installed on their computers that stole information and sent similar bogus messages to their friends on the site.

The most recent Facebook attack came in the form of messages claiming to be from friends that wanted to share digital video of the receivers.

Clicking on the link results in a prompt to download viewing software that is actually a computer worm called Koobface, a variation on the spelling of Facebook.

"It steals your cookie on your desktop; not just for Facebook but for a half-dozen social networking websites including MySpace," Yaneza said.

"Your account is compromised at that point. Using the hijacked cookie it tries to log in as you, goes through your address book and starts posting messages and comments."

Internet services routinely install small bits of software, called "cookies," on users' computers to store identifying information that can include user names and passwords.

Facebook and other social-networking websites that let outside developers customize Web-2.0 style widgets for users need to beef-up vetting processes to guard against "rogue developers," according to Yaneza.

He cited the stringent vetting process that Apple puts developers through before making third-party applications available at iTunes for iPhones and iPod Touch devices.

People can reduce the odds of becoming victims by being selective about friends at social networking websites and not clicking on links that take them outside the walls of their online communities.

Computer users are also wise to use unique complex passwords for each online account so if hackers get hold of one virtual key it won't open other locks, according to Yaneza.

(c) 2009 AFP

Explore further: New defenses sought against GPS spoofing attacks

Related Stories

Recommended for you

Cryptocurrency rivals snap at Bitcoin's heels

January 14, 2018

Bitcoin may be the most famous cryptocurrency but, despite a dizzying rise, it's not the most lucrative one and far from alone in a universe that counts 1,400 rivals, and counting.

Top takeaways from Consumers Electronics Show

January 13, 2018

The 2018 Consumer Electronics Show, which concluded Friday in Las Vegas, drew some 4,000 exhibitors from dozens of countries and more than 170,000 attendees, showcased some of the latest from the technology world.

Finnish firm detects new Intel security flaw

January 12, 2018

A new security flaw has been found in Intel hardware which could enable hackers to access corporate laptops remotely, Finnish cybersecurity specialist F-Secure said on Friday.

0 comments

Please sign in to add a comment. Registration is free, and takes less than a minute. Read more

Click here to reset your password.
Sign in to get notified via email when new comments are made.