InfoSec Tools, Tips & Thoughts » Social Networking

Sweet!! Yourr bootyy look awseome on thiss ivdeo!

William McBorrough, MSIA, CISSP, CISA, CRISC, CEH — Sat, 14 Aug 2010 20:10:22 +0000

Gee Thanks! I’ve been working out! …..oh wait a minute! What video??? CLICK!!!!

That was probably the script the culprit had in mind …and who knows how many times it played out.

I received the following message in my email inbox earlier from a cousin on Facebook.

It was so obviously malicious. Never mind the spelling issues. That is a trick typically used to get by email filters. My first reaction was to log in to Facebook and verify that it was indeed the source. I was reminded of an article I read about a similar fake LinkedIN email attack. In this case, the message was right there with a slight difference. The link now was more obvious.

One of those shortened bit.ly links that could lead you anyway. Without clicking the link, I clicked “reply” asking ” Did you send this?” . I already knew the answer but hey! I immediately got the following response from one of the sender’s friends.

The plot thickens…

I sent the cousin a message advising a change of Facebook credentials. The message was apparently sent to many other users. I’ve read and blogged about compromised Facebook account being used to spread malware and/or lure users to malicious sites but this is my first such experience. I’m not the average Facebook user though, since I only use it to cross-post blog updates. I didn’t have to time to investigate what’s on the other side of that bit.ly link but just thought I’d share the experience.

Beware fellow Facebook users!

Brevity is the soul of…..getting yourself infected with all kinds of nasties! Would you click on the link : http://www.click-here-to-give-me-access-to-all-your-computer-files.com? No? How...
Alert your connections if your Social Networking Account get compromised Social Network attacks are becoming more popular as daily we...
Fake virus alert spreads massively across Facebook Panda Security has released the following advisory: In the last...

Security On A Shoestring SMB Budget

William McBorrough, MSIA, CISSP, CISA, CRISC, CEH — Thu, 08 Jul 2010 15:03:49 +0000

The e-mail appeared to be an invitation from an old, junior high school friend. Yet when the hospital employee clicked on the link, it instead led her to a malicious site that installed a Trojan horse on her computer. In a little over a week, international cybercriminals used that beachhead to steal more than $600,000 from the woman’s employer, according to a terse description of the incident on the Information Systems Security Association’s Web site.

A number of similar incidents to this one highlight the threats of online crime facing small and midsize businesses (SMBs), says Stan Stahl, president of Citadel Information Group and president of the Los Angeles chapter of the ISSA.

“Typically, they say, ‘We have firewalls in place and have AV on all the desktops, so I guess we are secure,’” Stahl says. “But today cybercrime is so sophisticated that is not enough anymore.”

Read full article at http://www.darkreading.com/smb-security/security/attacks/showArticle.jhtml?articleID=225702557&cid=RSSfeed

Thoughts on Skype security Michael Gough, an information security specialist and president of the...
Did Facebook CEO play fast and loose with user login data? Did you Facebook CEO play fast and loose with user...
IRS reminds you not to go Phishing this tax season It’s tax time again and IRS phishing scams are alive...

What is the values proposition for allowing users access to social networks?

William McBorrough, MSIA, CISSP, CISA, CRISC, CEH — Mon, 21 Jun 2010 18:36:38 +0000

What is the values proposition for allowing employees access to web 2.0 resources such as social networks?

Every other day, we hear about the risks. Compromised Twitter accounts, phishing via LinkedIN, malicious Facebook apps were only a sample of an every growing landscape. Most enterprises, appreciating the threats these pose to an environment, simply deny access to social networks from company systems and networks.

Even within such organizations, there are user who need to access social networks to perform their job functions. LinkedIN has become a great tool for recruiting prospective new hires. More companies are using Twitter, Facebook, Myspace and others to promote their business an connect with customers.

But outside of that, is there a value in allowing employees, whose job function do not require it, access to social networks on company systems?

I’m prompted to ask this because last week I was at a meeting of the Northern Virginia chapter of the Information Systems Security Association (ISSA-NOVA) and the speaker was the deputy CISO of the IRS, Devon Bryan. He spoke about how the IRS was dealing with the security challenges posed by Web 2.0, particularly social networking, Their current stance is to block all access except for those employees who job function required it. Most security professionals would agree this is probably wise. However, he also added that they are looking at technology that would allow users to “view” social networking sites, but not allow them to “update” them. As he explained, or tried to, read vs. write/execute.

As this was an audience full of security professionals, it was quickly pointed out that drive-by malware downloads only require the user to browse the infected web page or one that is linked to an infected web page. To view is to infect, so to speak. There was then talk of how to mitigate that using virtual machines or proxies.

I have no doubt the technical challenges can be overcome. The hackers who now treat social networks as the new frontier will probably change tact to react as well. Besides wanting to keep employees happy, what’s the policy rationale for allow users to follow their subscribed tweets or friends updates? Never mind, the adverse effect this with have on productivity. Really, why bother?

How to limit Twitter risks Twitter is now used by over 350 million people worldwide....
Staff Leak Military Secrets on Facebook and Twitter Are your employees ( or you ) leaking sensitive data...
Gartner predicts the Enterprise is going Social Gartner believes that social networking will be embraced, but perhaps...

1000 hacked Facebook accounts for as low as 25 dollars

William McBorrough, MSIA, CISSP, CISA, CRISC, CEH — Mon, 17 May 2010 17:02:43 +0000

Facebook claims to have identified the self-proclaimed Russian hacker calling himself ” Kirlios” . Newswire report over the weekend reported that Kirlios had succeed in hacking a large number of Facebook accounts. On hacker forums, Kirlios has been offering up Facebook accounts for sale in batches of 1000 – up to 1.5 million in total. The going price is between $25 and $45 a batch. Quite reasonable really.

Facebook claims they turned the information about the hacker to law enforcement authorities and that the hacker’s claims are grossly overstated. Even if this guy is caught, extradition to the US is unlikely. Russia’s stance on this sort of thing is ” show us the proof and we will prosecute him ourselves”.

Hacker Updates Woman Facebook Status Here’s an interesting story. Who didn’t see this coming? “Police...
Did Facebook CEO play fast and loose with user login data? Did you Facebook CEO play fast and loose with user...
Facebook to share your information with other sites Facebook users are expressing strong disapproval of proposed privacy changes...

Blippy to hire a CSO after exposing credit card data

William McBorrough, MSIA, CISSP, CISA, CRISC, CEH — Tue, 27 Apr 2010 19:11:06 +0000

So…. I made this post about the Social Media fallacy that is Blippy. Well true to form, here we are less than two months later finding out…

“Blippy, a social networking site that allows users to share their purchases and discuss shopping with others, will revamp its security plans and hire a Chief Security Officer after an embarrassing incident in which the site accidentally published a few of its members’ credit card numbers on Google.

Blippy Co-founder and CEO Ashvin Kumar said in a blog post this week that the slip-up occurred as a result of a technical oversight back in February that caused raw transaction data to appear within the HTML code on some Blippy pages for about half a day. ”

Who didn’t see this coming a mile away? Presenters at Shmoocon this year noted that penetration testers [and hackers] absolutely love this the Blippy platform because of the naked insight it offers into the spending habits of specific individuals. They also shared a favorite quote making its way around the infosec community: “I joined Blippy and all I got was jacked at the ATM.”"

Sigh

Blippy, the Next Evolution of Stupid At what point do we as a society realize this...
CISSP All In One Book FIFTH EDITION has been released The fifth edition of this best-selling comprehensive CISSP training resources...
ISSA-NOVA Chapter December Meeting The Northern Virginia Chapter of the Information System Security Association...

Google rolls out privacy reset for Buzz

William McBorrough, MSIA, CISSP, CISA, CRISC, CEH — Mon, 05 Apr 2010 19:39:33 +0000

Google will ask users of its social network Buzz to review their privacy settings starting April 5.

This follows a series of privacy related concerns and updates following the initial launch of the service. I mentioned some of the concerns here in a post: Google Acknowledges Privacy Issues With Buzz amid FTC complaint

The latest tweaks will also show every aspect of a user’s profile, from public settings to the websites users are connected to, and who they are following or being followed by.

“Shortly after launching Google Buzz, we quickly realised we didn’t get everything right and moved as fast as possible to improve the Buzz experience,” said Buzz product manager Todd Jackson in a blog post.

“Offering everyone who uses our products transparency and control is very important to us.”, he continues.

The blogosphere has reacted positively to the proposed changes.

“While we can say that this is what we wanted at launch, it is heartening to see it now,” said Alex Wilhelm, of TheNextWeb.

Ben Parr, associate editor at social media blog Mashable, said that while the changes could not fix the damage already done, they might “help get Congress off [Google's] back”.

“If it can appease critics on the privacy issues, then it can tackle the bigger challenge: making Google Buzz into a competitive threat to Twitter and Facebook.”

The Google Buzz team has promised more updates in the future.

Google Acknowledges Privacy Issues With Buzz amid FTC complaint Although Google has acknowledged some of the privacy concerns with...
Facebook, Twitter, ….Buzz? Update: Power to the people!! In response to the concerns...
Facebook to share your information with other sites Facebook users are expressing strong disapproval of proposed privacy changes...

Facebook error exposes users hidden email addresses for 30 minutes

William McBorrough, MSIA, CISSP, CISA, CRISC, CEH — Wed, 31 Mar 2010 18:37:30 +0000

I swear I am not on an anti-Facebook crusade, but the endless drip, drip, drip of security issues is astounding. So is Facebook just worse than the rest when it comes to security? I think not. It’s just that they are the most popular and receive the most attention. In other words, ALL social networking sites have these issues.

“Last night during Facebook’s regular code push, a bug caused hidden email addresses to be visible briefly,” said a Facebook spokesman yesterday.

This new calamity lasted for 30 minutes.

Hacker Updates Woman Facebook Status Here’s an interesting story. Who didn’t see this coming? “Police...
Facebook to share your information with other sites Facebook users are expressing strong disapproval of proposed privacy changes...
1000 hacked Facebook accounts for as low as 25 dollars Facebook claims to have identified the self-proclaimed Russian hacker calling...

Facebook to share your information with other sites

William McBorrough, MSIA, CISSP, CISA, CRISC, CEH — Tue, 30 Mar 2010 17:52:03 +0000

Facebook users are expressing strong disapproval of proposed privacy changes will let the site share some user information with third-party Web sites and applications. Have you added your voice? These social networking sites have a captive audience which many businesses will pay a pretty penny to have access to and get information about.

When Google decided to unilaterally opt Gmail users into Buzz and share your contact information, it received bad press and an FTC filing. I can only hope the same and more happens here.

Under Facebook’s current rules you’re asked first if you want to share information (your name, photos and friends list) with third-party sites. The proposed policy, which Facebook hasn’t implemented yet, would bypass asking you for approval when visiting some sites and applications Facebook has business relationships with, sharing limited personal information automatically.

Tell Facebook how you feel about it here: http://blog.facebook.com/blog.php?post=376904492130

Beware of fake Facebook apps Facebook is warning users to avoid bogus apps that claim...
Did Facebook CEO play fast and loose with user login data? Did you Facebook CEO play fast and loose with user...
Facebook intros Revamped Home Page, Important New Privacy Setting On Friday, Facebook rolled out a new home page and...

Don't install fake Facebook Antivirus

William McBorrough, MSIA, CISSP, CISA, CRISC, CEH — Mon, 29 Mar 2010 16:20:40 +0000

Alas, another day, another Facebook security alert.

As soon as you install this malware, it will tag every single one of your friends in a photo in batches of about 20. It then posts that photo to your wall.

This is what the photo looks like:

If a Friend looking through the photos then clicks on the app’s link, they’ll see this:

If you have a lot of friends, you might end up with a series of albums like this:

Apart from the wall spamming, another obvious indication that this is a virus itself, is the url:

http://apps.facebook.com/kxetyegpgkxdwfy/

A valid application is not going to have a url with a bunch of jumbled letters at the end.

If you have been tagged in the photo by one of your friends (remember, they did not really do this – the app did automatically), you can remove the tag.

1. Open your photos
2. Click the offending picture
3. Look for your name in the list of people tagged
4. Click the ‘Remove Tag’ link that appears beside your name

The photo will then automatically be removed from your photo list.

Source:

http://www.f-secure.com/weblog/archives/00001920.html

http://thefacebookinsider.com/2010/03/warning-facebook-antivirus-will-virally-spam-your-friends/

Beware of fake Facebook apps Facebook is warning users to avoid bogus apps that claim...
Facebook intros Revamped Home Page, Important New Privacy Setting On Friday, Facebook rolled out a new home page and...
Fake virus alert spreads massively across Facebook Panda Security has released the following advisory: In the last...

Facebook "Friend" Suspected in Burglary

William McBorrough, MSIA, CISSP, CISA, CRISC, CEH — Thu, 25 Mar 2010 17:34:17 +0000

“I think the social networking sites are good to have,” she said. “You just have to be smart about it. Because just because you’re trustworthy and a nice person does not mean everyone on your Facebook is. So you can’t put your address — my address wasn’t even listed — or your phone number or that you’re home alone or going out of town.”

That’s a quote from a woman whose house was robbed by a Facebook “friend” after she updated her status indicating she was on her way to a concert. She appeared on the CBS Early Show this morning. The robber had contacted her six month previously claiming to be long lost neighbor from 20 years ago. Fortunately for her, she had cameras installed at home and recorded the culprit in the act.

I can’t stress enough the importance of limiting the information you put out there. With friends like these, ….

Source: CBS NEWS

2010 CyberSecurity Watch Survey Cybercrime threats posed to targeted organizations are increasing faster than...
Facebook to share your information with other sites Facebook users are expressing strong disapproval of proposed privacy changes...
SMB Cyber Security Alliance helps Small Businesses address Cyber Security Risks Across all industries, small businesses are increasingly facing new threats...

Hacker Updates Woman Facebook Status

William McBorrough, MSIA, CISSP, CISA, CRISC, CEH — Wed, 24 Mar 2010 16:42:01 +0000

Here’s an interesting story. Who didn’t see this coming?

“Police say a hacking investigation in Fairfax County, Virginia started with a Facebook pregnancy announcement. But, it turns out the woman is not expecting a baby.

According to police, someone hacked into her Facebook account and posted the fake status update. The victim, who is from Springfield, also claims someone accessed her Hotmail account and sent out nasty emails.

All of the victim’s classes at Northern Virginia Community College were canceled by the hacker.

Police are investigating the Facebook and Hotmail hacking claims, but so far no charges have been filed.”

Source: http://www.myfoxdc.com/dpp/news/local/woman-says-facebook-account-was-hacked

1000 hacked Facebook accounts for as low as 25 dollars Facebook claims to have identified the self-proclaimed Russian hacker calling...
Did Facebook CEO play fast and loose with user login data? Did you Facebook CEO play fast and loose with user...
ISSA-NOVA Chapter December Meeting The Northern Virginia Chapter of the Information System Security Association...

Don't plan Federal Crimes on Facebook!

William McBorrough, MSIA, CISSP, CISA, CRISC, CEH — Sat, 20 Mar 2010 00:39:28 +0000

There have been numerous stories recently about the fact that the feds are trolling the social networking scene looking for…..whatever it is feds look for. I’m not sure why this is news or even unexpected. This is standard fare offline why should it be any different online where it is a lot easier to people to connect and share ideas good or bad. Is Facebook and Twitter sharing all my activities with the Man.? If so then they will have already sen this post before you did because my blog posts are automatically published on Facebook, Twitter, Myspace, Friendfeed, and a few more. Hey, I’m just trying to spread the word here. Are any of the folks you follow on Twitter under suspicion by the feds for…..whatever feds suspect folks of? How about your friends or fans on Facebook or some other networks? How would you know if they are? Man, this could get messy. But honestly, if they listen to your phone calls, why wouldn’t they track your online activity. I fully understand and appreciate the privacy concerns but I’m a realist. It’s happening, folks. Don’t plan any federal crimes on Facebook!

Check out FBI Going Rogue on Facebook on DarkReading.com

Facebook and Twitter I have never found much use for social networking sites...
Blippy, the Next Evolution of Stupid At what point do we as a society realize this...
Alert your connections if your Social Networking Account get compromised Social Network attacks are becoming more popular as daily we...

Beware of fake Facebook apps

William McBorrough, MSIA, CISSP, CISA, CRISC, CEH — Wed, 17 Mar 2010 23:01:44 +0000

Facebook is warning users to avoid bogus apps that claim to allow users to see who is viewing their profile. In a statement, Facebook said:

“Don’t believe any applications that claim they can show you who’s viewing your profile or photo. They can’t.”

Maybe it’s time Facebook reviewed it’s policy regarding vetting third-party applications.

Facebook to share your information with other sites Facebook users are expressing strong disapproval of proposed privacy changes...
Facebook intros Revamped Home Page, Important New Privacy Setting On Friday, Facebook rolled out a new home page and...
CISSP All In One Book FIFTH EDITION has been released The fifth edition of this best-selling comprehensive CISSP training resources...

Paper details Attack to De-Anonymize Social Network Users

securnetworks — Mon, 08 Mar 2010 16:58:26 +0000

Interesting paper: “A Practical Attack to De-Anonymize Social Network Users.”

Abstract. Social networking sites such as Facebook, LinkedIn, and Xing have been reporting exponential growth rates. These sites have millions of registered users, and they are interesting from a security and privacy point of view because they store large amounts of sensitive personal user data.

In this paper, we introduce a novel de-anonymization attack that exploits group membership information that is available on social networking sites. More precisely, we show that information about the group memberships of a user (i.e., the groups of a social network to which a user belongs) is often sufficient to uniquely identify this user, or, at least, to significantly reduce the set of possible candidates. To determine the group membership of a user, we leverage well-known web browser history stealing attacks. Thus, whenever a social network user visits a malicious website, this website can launch our de-anonymization attack and learn the identity of its visitors.

The implications of our attack are manifold, since it requires a low effort and has the potential to affect millions of social networking users. We perform both a theoretical analysis and empirical measurements to demonstrate the feasibility of our attack against Xing, a medium-sized social network with more than eight million members that is mainly used for business relationships. Our analysis suggests that about 42% of the users that use groups can be uniquely identified, while for 90%, we can reduce the candidate set to less than 2,912 persons. Furthermore, we explored other, larger social networks and performed experiments that suggest that users of Facebook and LinkedIn are equally vulnerable (although attacks would require more resources on the side of the attacker). An analysis of an additional five social networks indicates that they are also prone to our attack.

Gartner predicts the Enterprise is going Social Gartner believes that social networking will be embraced, but perhaps...
Did Facebook CEO play fast and loose with user login data? Did you Facebook CEO play fast and loose with user...
What is the values proposition for allowing users access to social networks? What is the values proposition for allowing employees access to...

Did Facebook CEO play fast and loose with user login data?

William McBorrough, MSIA, CISSP, CISA, CRISC, CEH — Mon, 08 Mar 2010 17:52:16 +0000

The business insider recently ran a series of disturbing stories about the founding of Facebook. The allegations are that Facebook founder and CEO, Mark Zuckerberg, stole the idea of a social network from group of fellow Harvard students who had asked for his help build their own social networking site. After lauching Facebook and being accused of stealing the idea, he used account information of site users to hack into email accounts belonging the the school newspaper which was investigating the allegations.

Be it true or otherwise, this just highlights one of the many risks associated with social networking sites. Although, Facebook didn’t not have the “privacy” policy it has today at the time of the alleged misconduct, policy is all that stands between your information and some disgruntled or unscrupulous Facebook (or any other social networking site ) employee.

Most social networking sites use your email address as your user name. Are you using the same password for both accounts? You shouldn’t. However, since these sites record all failed log in attempts, if you at times have had to circle through the your series of usual account passwords then rest assured those passwords are captured as well.

Know your risks.

Facebook to share your information with other sites Facebook users are expressing strong disapproval of proposed privacy changes...
How to limit Twitter risks Twitter is now used by over 350 million people worldwide....
Facebook error exposes users hidden email addresses for 30 minutes I swear I am not on an anti-Facebook crusade, but...

Beware of Chile Earthquake Scams

Guest Blogger — Mon, 01 Mar 2010 02:18:43 +0000

An 8.8 magnitude earthquake struck Santiago, Chile in the early hours of February 27th. Tsunami warnings, encompassing most of the Pacific Ocean, soon followed. These types of breaking news events often spur a surge in social engineering scams which exploit interest in the events.

Commonly, scam artists might seed search engine results (particularly sponsored ads) with bogus links that point to scareware sites. These can appear for any search on keywords such as Chile earthquake, Tsunami, etc. The best way to avoid such scams is to avoid clicking on links that point to unfamiliar sites. In particular, avoid donating charitable funds via unfamiliar sites or as a result of a solicitation received via email, Twitter, instant message, Facebook, or other social networking medium.

Google has prepared a fully vetted information site for the Chilean earthquake, including relief efforts and reputable disaster relief funds:http://www.google.com/relief/chileearthquake/.

Source: http://antivirus.about.com/b/2010/02/27/be-on-alert-for-chile-earthquake-scams.htm

Beware of Haiti-Themed Scams and Attacks! Our thoughts and prayers go out to all those affected...
IRS reminds you not to go Phishing this tax season It’s tax time again and IRS phishing scams are alive...
"Show me the malware"- says Google A fews weeks ago, I had a discussion with a...

Blippy, the Next Evolution of Stupid

William McBorrough, MSIA, CISSP, CISA, CRISC, CEH — Sun, 28 Feb 2010 18:43:42 +0000

At what point do we as a society realize this is getting out of hand? As more and more stories surface of Twitter accounts being hacked, Facebook accounts being sold on the cybercrime black market, Gmail accounts being compromised, etc, one would think sooner or later, folks would start getting the message that putting your private information online is not a good idea.

I’ve just happened across Blippy, a Twitter-like site, where users can sign up to publish all their online purchases. I mean, really?? We already know that retailers track your purchases and use it for marketing purposes. Why in the world would you publish all your credit card transactions to the world??

I have a Twitter account ( Follow me ) that I use for one purpose: publishing my blog posts and other security related articles I come across on the web. That’s it! I doubt anyone cares to know what I do with my every waking moment nor do I care to tell.

Good luck though. Sigh.

Twitter users hit hard by "LOL" phishing attack IT security and data protection firm Sophos is warning that...
How to limit Twitter risks Twitter is now used by over 350 million people worldwide....
Brevity is the soul of…..getting yourself infected with all kinds of nasties! Would you click on the link : http://www.click-here-to-give-me-access-to-all-your-computer-files.com? No? How...

Google Acknowledges Privacy Issues With Buzz amid FTC complaint

William McBorrough, MSIA, CISSP, CISA, CRISC, CEH — Tue, 23 Feb 2010 23:27:04 +0000

Although Google has acknowledged some of the privacy concerns with Buzz and is taking [baby] steps to address them, the Electronic Privacy Information Center (EPIC) on filed a complaint with the Federal Trade Commission about Google Buzz last week. “The primary issue is that users who signed up for Gmail have now found themselves users of a social networking service,” said Jared Kaprove, EPIC’s domestic surveillance counsel, in a phone interview. “E-mail is not completely private, but it’s ordinarily thought of as a private process.”

The problem, as framed by the Electronic Frontier Foundation, “is that your e-mail and chat contacts are not necessarily people you want to advertise as friends via a public social network.”

Google could have saved itself all the trouble by making this an opt-in service. But alas, no.

Google rolls out privacy reset for Buzz Google will ask users of its social network Buzz to...
The Death of [the illusion of] Privacy on the Internet If this doesn’t scare you, it should. The Washington Post,...
Facebook, Twitter, ….Buzz? Update: Power to the people!! In response to the concerns...

Alert your connections if your Social Networking Account get compromised

William McBorrough, MSIA, CISSP, CISA, CRISC, CEH — Tue, 23 Feb 2010 22:16:39 +0000

Social Network attacks are becoming more popular as daily we receive news of accounts being compromised or credentials stolen and sold. What do you do when you find yourself fallen victim to such as attack? NetworkWorld has some suggestions:

Acknowledge the attack to anyone who might have been adversely impacted; Be detailed: Tell them what message they might have received as a result of the malware/phishing and what might have happened as a result; Caution your contacts: Use this as an opportunity to remind everyone that just because they think a message comes from someone they know, there really is no way of telling for sure. If they ever do click a link that then leads to a login page or to a video codec install, they should close the page immediately and contact their friend via some other method to inquire (and possibly alert them) about the seemingly malicious link.

When Twitter accounts are phished, the 140 character limitation makes it a bit harder to convey the message. Using as few words as possible, try to include enough details about the message sent so folks can identify it, ended with a brief “I’m sorry”. Don’t ever include a link in that apology; after all, it was clicking on a link that got folks in trouble in the first place.

Sweet!! Yourr bootyy look awseome on thiss ivdeo! Gee Thanks! I’ve been working out! …..oh wait a minute!...
Brevity is the soul of…..getting yourself infected with all kinds of nasties! Would you click on the link : http://www.click-here-to-give-me-access-to-all-your-computer-files.com? No? How...
Your guilty conscience could get you pwned From Trend Micro Countermeasures Blog: I just received an email...

Google = Hubris! The Buzz Fiasco

William McBorrough, MSIA, CISSP, CISA, CRISC, CEH — Sun, 14 Feb 2010 00:36:10 +0000

Raise your hand if you have a Gmail account you use only for business. So how do you feel about the fact that Google decided to automatically add a social networking component into your business account, connect you with those you frequently communicate AND made that information public by publishing it on the profiles of all your connections. Are you a doctor? Lawyer? This should be hugely problematic to you. The pure hubris of this doesn’t astound me as we are talking able Google here but where is the uproar? The OUTRAGE?? The press coverage??

I dare say any other company might have made this an opt-in feature thus allowing users who chose to have this functionality to enable is consciously. This is the right way to do it.

But wait, it gets worse: The “turn off buzz” switch provided doesn’t actually disable it. It just hides it within Gmail. All your connections still show up in your profile page and Buzz is still active. Accessing your account from a mobile device will show Buzz enabled.

CNET has posted an article on how to properly disable buzz, include screenshots. The steps include:

First, you delete your google profile. You don’t hide it or change the name. You have to delete it completely. This doesn’t destroy your overall google account, but it does limit some of your functions. Here’s how to delete your profile.
You have to go into buzz and manually delete your connections, including blocking everyone who is following you already.
Now it’s safe to go back to Gmail and click “turn off buzz.”

Google rolls out privacy reset for Buzz Google will ask users of its social network Buzz to...
Google Acknowledges Privacy Issues With Buzz amid FTC complaint Although Google has acknowledged some of the privacy concerns with...
Facebook, Twitter, ….Buzz? Update: Power to the people!! In response to the concerns...

Facebook, Twitter, ….Buzz?

William McBorrough, MSIA, CISSP, CISA, CRISC, CEH — Fri, 12 Feb 2010 20:18:32 +0000

Update: Power to the people!! In response to the concerns raised over the privacy of status updates (see below), Google has revamped the buzz interface to give users more (obvious?) control over who can view that information.See blog post from Google Product Manager, Todd Jackson

http://gmailblog.blogspot.com/2010/02/millions-of-buzz-users-and-improvements.html

Not leaving any stone unturned, Google has joined the Social Networking foray. Earlier this week, Google introduced Google Buzz which adds social networking features to Gmail. Will this be the one to replace them all? Or just another addition to the long list? Check it video below.

Here’s a great feature that should interest you. Buzz compiles a list of the Gmail contacts you most frequently email or chat with and automatically starts following these people. It also makes the list public, meaning strangers can see who Buzz users have been in contact with. Emailed an old girlfriend/boyfriend lately? How about a recruiter at a competitor company? Don’t get buzzed, folks!

Google rolls out privacy reset for Buzz Google will ask users of its social network Buzz to...
Google Acknowledges Privacy Issues With Buzz amid FTC complaint Although Google has acknowledged some of the privacy concerns with...
Facebook to share your information with other sites Facebook users are expressing strong disapproval of proposed privacy changes...

Facebook intros Revamped Home Page, Important New Privacy Setting

William McBorrough, MSIA, CISSP, CISA, CRISC, CEH — Sun, 07 Feb 2010 02:53:51 +0000

On Friday, Facebook rolled out a new home page and privacy settings.

And whenever Facebook adds new features, in this case the Applications and Games dashboards, there’s usually a new privacy setting as well.

This is what part of the new Applications dashboard looks like.

All Facebook has raised some privacy concerns regarding the dashboard’s output.

Do you really want all of your “friends” to know what applications you’ve been running?

You don’t?

Then you’ll want to take a look at the new control provided by Facebook.

Here’s the old Applications and Websites settings page.

Here are the new settings.

The new privacy option allows you to “Control who can see your activity in the Friends’ Recent Activity, Friends’ Applications and Friends’ Games sections of these pages.”

The control options should be familiar enough at this point. Sharing can be set to Only Friends, Friends of Friends and Everyone.

Of course, utilizing Friends Lists can limit access in a more refined manner.

Although, I applaud for taking these steps, your data is always just a software bug or system configuration error away from being exposed. If you don;t want it out there, don’t put it on social networks.

Source: http://www.f-secure.com/weblog/archives/00001875.html

Facebook to share your information with other sites Facebook users are expressing strong disapproval of proposed privacy changes...
Don't plan Federal Crimes on Facebook! There have been numerous stories recently about the fact that...
Beware of fake Facebook apps Facebook is warning users to avoid bogus apps that claim...

How to limit Twitter risks

William McBorrough, MSIA, CISSP, CISA, CRISC, CEH — Thu, 04 Feb 2010 17:00:32 +0000

Twitter is now used by over 350 million people worldwide. However, Twitter is also gaining a reputation as security risk for individuals and organizations. Every business or organization which uses Twitter (or any other social media or networking site) should have a strong policy in place (and enforced) that clearly states how it should be used by employees.

They need to be aware of the consequences of sending out seemingly innocent tweets which could still get them into deep trouble. In December 2009, a Vodafone employee was fired after his post was deemed by the company to go against fair competition. Drastic? Maybe, but it showed that even a humorous post could backfire.

Some basic rules to limit the risks posed by Twitter and other social networking sites include:

1. Think twice before posting. Employees need to think compliance, integrity, security… then post.

2. Access URLs in tweets with care. If there is no real need to check out the site, leave it.

3. Show employees what to look out for. How to notice when someone is stalking or attempting to social engineer information.

4. Avoid confrontation on Twitter. It is a great tool for customer feedback but a disaster in resolving issues.

5. Create a policy in a language that is understood by employees. Have them sign it. There should be no excuses that they did not know what they could or could not say.

Staff Leak Military Secrets on Facebook and Twitter Are your employees ( or you ) leaking sensitive data...
Twitter makes security enhancements to help users Twitter has added a new service that detects malicious URLs...
What is the values proposition for allowing users access to social networks? What is the values proposition for allowing employees access to...

Gartner predicts the Enterprise is going Social

William McBorrough, MSIA, CISSP, CISA, CRISC, CEH — Wed, 03 Feb 2010 22:37:19 +0000

Gartner believes that social networking will be embraced, but perhaps not in the way we thought they would. The report bodes both well and ill. I’ve read at least ten news stories today related to security issues and risks associated with social networking.

Gartner’s five social software predictions for 2010 and beyond:

By 2014, social-networking services will replace e-mail as the primary vehicle for interpersonal communications for 20 percent of business users.
By 2012, over 50 percent of enterprises will use activity streams that include microblogging, but stand-alone enterprise microblogging will have less than 5 percent penetration.
Through 2012, more than 70 percent of IT-dominated social media initiatives will fail.
Within five years, 70 percent of collaboration and communications applications designed on PCs will be modeled after user experience lessons from smartphone collaboration applications.
Through 2015, only 25 percent of enterprises will routinely utilize social network analysis to improve performance and productivity.

What I find most interesting is the prediction that most social networking projects will fail. Hmmmm

Paper details Attack to De-Anonymize Social Network Users Interesting paper: “A Practical Attack to De-Anonymize Social Network Users.”...
Did Facebook CEO play fast and loose with user login data? Did you Facebook CEO play fast and loose with user...
Facebook poses biggest security threat to businesses According to it’s Security Threats 2010 report published today, security...

How much is your Twitter Account worth on the Hacker Underground?

William McBorrough, MSIA, CISSP, CISA, CRISC, CEH — Fri, 29 Jan 2010 20:21:22 +0000

Well, that depends on the name of your account and the number of followers naturally. According to researchers at Kaspersky Lab, hackers are trying to sell hacked Twitter user names and passwords on-line for hundreds of dollars. Cybercriminals are looking for an initial, trusted, stepping stone from which to send malicious Twitter messages and, ideally, infect more machines. Imagine a tweet coming from “you” to all your family, friends, co-workers, etc informing them of something particularly interesting just one click away. Naturally the link will be shortened , so they will have no clue where it leads Most will click on it with the confidence that it came from you. That’s all it takes.

One Twitter account, with just over 320 followers, was reportedly offered at $1,000 in an underground hacker forum. The user’s name was a simple three letter combination that might make it more valuable to criminals. Social networks are really the new battlefield and the bad guys are winning.

Source: http://www.computerworld.com/s/article/9150001/Stolen_Twitter_accounts_can_fetch_1_000

United States Department of Defense Embraces Hacker Certification Mar 01, 2010 – The U.S. Department of Defense (DoD)...
More on Forensics… Follow what the NOVA Information Assurance Strike Team is up...
Staff Leak Military Secrets on Facebook and Twitter Are your employees ( or you ) leaking sensitive data...

Staff Leak Military Secrets on Facebook and Twitter

William McBorrough, MSIA, CISSP, CISA, CRISC, CEH — Wed, 27 Jan 2010 18:10:40 +0000

Are your employees ( or you ) leaking sensitive data over the social networks? This report from the UK should give you pause.

The Ministry of Defence has admitted that staff leaked secret information 16 times on social networking sites such as Facebook and Twitter over an 18-month period.

The admission comes in response to a Freedom of Information request by Lewis PR, which handles public relations for security firm F-Secure.

Lewis said the Ministry of Defence had disciplined 10 personnel, although was unable to specify individual cases.

Are your employees leaking your sensitive data via social networks? This report from the UK should give anyone pause.

Ministry of Defence staff aren’t banned from using social networks, but Lewis pointed out that the department’s code tells employees: “Remember you are a member of HM Forces/MOD civil servant. Observe the same high standard of conduct and behaviour online as would be expected of you in your professional or personal life.”

However, F-Secure said the Ministry of Defence should do more to ensure the guidelines are adhered to.

“It’s worrying that employees in sensitive positions have been sharing confidential information via Twitter and other means,” said F-Secure’s security expert Mikko Hypponen

“They might think they are confiding in friends or family when they go on Facebook. However, the recent changes in Facebook’s privacy settings might make them disclose information to the world. This is a potential security risk.”

Source: http://www.csoonline.com/article/525613/MoD_Staff_Leak_Military_Secrets_on_Facebook_and_Twitter

How to limit Twitter risks Twitter is now used by over 350 million people worldwide....
What is the values proposition for allowing users access to social networks? What is the values proposition for allowing employees access to...
Facebook, Twitter, ….Buzz? Update: Power to the people!! In response to the concerns...

2010 Year of the Zombie Cloud

William McBorrough, MSIA, CISSP, CISA, CRISC, CEH — Wed, 27 Jan 2010 17:27:20 +0000

As more organizations consider moving into the cloud to benefit from the evident cost savings and focus more on their core business functions, the bad guys are also looking for the benefits.

2009 has been a notable year for malware and malicious online activity for a number of reasons and several of them relate to what is known as botnets. A zombie, or a bot, is a PC infected by malware that brings it under the remote control of a criminal. Criminals run networks that can range from thousands to millions of infected machines and they use them to power most of the cybercrime we see today including spam, DDoS, scareware, phishing, and malicious or illegal website hosting. They have a finger in every cybercriminal pie.

In the first half of the year, the Conficker worm (also known as Downadup or Kido) stole all the headlines in the malware world. Eventually the Conficker botnet was seen to deliver standard cybercriminal payloads, such as spambots and Fake AV (or scareware), much to the disappointment of some of the more hysterical commentators. Just because the outbreak received so much coverage that died away just as rapidly, don’t be fooled into thinking this threat has gone away. The Conficker Working Group, an alliance of security vendors, researchers and other commercial organisations is currently showing around 6 million unique IP addresses as appearing to be infected with this malware.

An unrelated, but important trend in 2009 was the exponential increase in the abuse of social networking providers for malicious purposes. The enormous active user populations on sites like Facebook, Twitter and MySpace prove a very attractive lure to organised online crime and its attendant money-making, bot recruitment and Fake AV pushing scams. Facebook has been abused by rogue Apps, designed to fool users into clicking links that reward the creator through pay-per-click affiliate advertising networks. It has also been used to spread malware through many means; malicious links in wall posts and messages, malware designed specifically to hijack accounts and by external compromise of legitimate Facebook Apps. The Koobface family of malware (also a botnet) has evolved over the course of 2009; it was initially spread through malicious messages and wall posts with links to fake YouTube sites punting a supposed codec in order to view the video. The codec of course was nothing of the sort and led to infection and account hijacking. Koobface now though has evolved to the point where it is fully capable of creating its own fake Facebook profile pages, complete with confirmed Gmail address, photo and biographical data. These fake accounts then set about joining networks and sending friend requests again all in a completely automated fashion.

Another fake security software alert I”ve previously warned of fake security software or scareware. Here’s...
Fake virus alert spreads massively across Facebook Panda Security has released the following advisory: In the last...
Sweet!! Yourr bootyy look awseome on thiss ivdeo! Gee Thanks! I’ve been working out! …..oh wait a minute!...

Brevity is the soul of…..getting yourself infected with all kinds of nasties!

William McBorrough, MSIA, CISSP, CISA, CRISC, CEH — Sun, 10 Jan 2010 01:20:34 +0000

Would you click on the link : http://www.click-here-to-give-me-access-to-all-your-computer-files.com? No?

How about http://www.bit.ly/12345? Not so threatening, is it?

Yet, those two links could just as easily take you to the same end. The rise of social networking services like Twitter which limits the number of characters a user can post to 140 has made link shortening services even more popular. Services like bit.ly and tinyurl.com allows one to mask a much longer url with a fairly short one. The risks here is that users have now grown accustomed to clicking on links and having no idea what they are clicking on. Oh I’m not so naive as to think most users actually read the entirely url before clicking. I know better. The point here is that those who chose to were able to. With link shortening services today, Cyber-criminals and spammers no longer have to go through the trouble of purchasing a nice-sounding domain name and redirecting your request to to their malicious server. It takes seconds to sign up with one of the free link shortening services and on you go.

I’m certainly not advocating against the use of such services as I use them myself to promote my blog on Twitter, Facebook and LinkedIN. I would advice that before you click on a shortened link, consider the source. How much do you trust the source? Give a little more thought before clicking.

Alert your connections if your Social Networking Account get compromised Social Network attacks are becoming more popular as daily we...
New Facebook Clickjacking Attack Here is a post by Stan Schroader warning users of...
Sweet!! Yourr bootyy look awseome on thiss ivdeo! Gee Thanks! I’ve been working out! …..oh wait a minute!...

New Facebook Clickjacking Attack

William McBorrough, MSIA, CISSP, CISA, CRISC, CEH — Tue, 22 Dec 2009 19:08:14 +0000

Here is a post by Stan Schroader warning users of a new Facebook clickjacking attack. Clickjacking is a malicious technique where users are tricked into clicking on hidden link that leads them to a webpage they didn’t intend. If this is web site that hosts malicious content, things can get a little hairy. If you are using a Firefox browser as I am, one way to protect yourself is to install the NoScript plugin which prevents users from clicking on invisible page elements.

Brevity is the soul of…..getting yourself infected with all kinds of nasties! Would you click on the link : http://www.click-here-to-give-me-access-to-all-your-computer-files.com? No? How...
Facebook to share your information with other sites Facebook users are expressing strong disapproval of proposed privacy changes...
More on Forensics… Follow what the NOVA Information Assurance Strike Team is up...