Facebook Privacy & Security Guide Updated to v2.1

The Facebook Privacy & Security Guide has been updated to version 2.1 to reflect recent changes that Facebook has made.  Updates to the guide include minor changes to the privacy navigation structure and details on the new “Instant Personalization” privacy setting.  Also, I included information on Facebook Ads.  Please print it out for your own use or share with friends and family!  Questions and comments can be posted here or sent to feedback[aT]socialmediasecurity.com.

Download the updated version of the Facebook Privacy & Security Guide

Security pros use layered techniques, but so do attackers

For many years security professionals have advocated using layered safeguards to reduce the risk of threats. While many organizations do employ multiple technologies like firewalls, anti-virus and intrusion detection to try to stop hackers, these guys are getting very good at navigating our layers of security. It’s like the old Mario and Donkey Kong video games where you had to jump over land mines, climb ladders, wait for doors to open and avoid swinging obstacles to reach the bonus prizes.

As an example of how many layers they are able to traverse, consider the reported attack on a financial institution’s enterprise network, which started life as a hacked Facebook account. (Click HERE for the full story.)

To make a long story short the attackers did the following:

  1. They captured the Facebook credentials of an individual who worked for a financial institution
  2. They then scanned the user’s Facebook profile to find recent social events involving co-workers on Facebook (finding a company picnic)
  3. They then sent emails to multiple Facebook friends who were co-workers saying, “Hey, have a look at the pictures I took at the company picnic!”
  4. The emails contained links to malicious web pages that attempted to launch a keylogger on the victims’ computers.
  5. They then scanned the keystrokes of an employee whose laptop had become infected with the keylogger and found the authentication credentials for the corporate VPN
  6. They infiltrated the VPN and infected a computer inside the corporate perimeter and performed vulnerability scans around the network to find servers with sensitive information on them.

The attack lasted as long as 2 weeks. If the attackers’ vulnerability scans had not been so “noisy”, they may not have been noticed, and the company could have suffered severe losses in terms of costly data breaches and corrupted databases, as well as system repairs.

So, what will happen now? Will the company add another layer of security to prevent a similar attack in the future? Probably… and these attackers will probably move on to other organizations with a bit less security. The cat and mouse game continues.

What’s interesting in this story is that the initial attack on the employees’ Facebook friends is pretty hard to defend against, since nothing seemed out of the ordinary. There really was a corporate picnic!

What would you do next if you were a security manager at this financial institution?

Social Media Security Podcast 8 – Would You Commit Social Media Suicide?

This is the 8th episode of the Social Media Security Podcast recorded January 8, 2010.  This episode was hosted by Tom Eston, Kevin Johnson and Scott Wright.  Below are the show notes, links to articles and news mentioned in the podcast:

Please send any show feedback to feedback [aT] socialmediasecurity.com or comment below.  You can also call our voice mail box at 1-613-693-0997 if you have a question for our Q&A section on the next episode.  You can also subscribe to the podcast in iTunes. Thanks for listening!

Social Media Security Podcast 7 – New Facebook Privacy Settings, Twitter Lists, FTC and Bloggers

This is the 7th episode of the Social Media Security Podcast recorded December 21, 2009.  This episode was hosted by Scott Wright and Tom Eston.  Below are the show notes, links to articles and news mentioned in the podcast:

Please send any show feedback to feedback [aT] socialmediasecurity.com or comment below.  You can also call our voice mail box at 1-613-693-0997 if you have a question for our Q&A section on the next episode.  You can also subscribe to the podcast in iTunes. Thanks for listening!

Fifteen significant social media & security events of 2009

I recently co-authored an article with Jennifer Leggio from ZDNet on the Fifteen significant social media & security events of 2009.  Be sure to check it out as there were *many* high profile attacks on social networks and their users this year.  The article also provides a preview of what we might see in 2010.  Thanks again to Jennifer for putting this article together!

Facebook Privacy & Security Guide v2.0: Updated with New Privacy Changes

I have updated and released version 2.0 of the popular Facebook Privacy & Security Guide.  Version 2.0 reflects the recent changes that Facebook made to it’s privacy settings.  In addition, I added a new section titled “Blocking and Creating Friend Lists” and expanded on how your Name, Profile Picture, Gender, Current City, Networks, Friend List, and Pages are now publicly available information.

Download the new version of the Facebook Privacy & Security Guide here.
You can also get to the guide from: socialmediasecurit… and from the top of Socialmediasecurity.com under “Guides”.

Can you remove public access to your friend list?
One tip I didn’t have room for in the guide around these new changes is the following.  You can remove the ability for your “Friend List” to be viewed in public searches by selecting the Edit “pencil” in the Friends box on your profile page and unchecking the box.  Here is a screen shot of this.  Unfortunately, this control is all or nothing but the good news is your Friends can still see your friends list.  You may also want review your application settings so application “boxes” are not showing on your public profile as well.  More information can be found on Facebook’s blog post about these issues (hat tip to @mubix for pointing this out).

Like before please send any feedback on the guide to feedback[ aT ]socialmediasecurity.com.  The companion video is being worked and should be up shortly as well.

Social Media Security Podcast 6 – Privacy, Photo Tagging, Facebook Police, What is Clickjacking

skullThis is the 6th episode of the Social Media Security Podcast recorded December 3, 2009.  This episode was hosted by Tom Eston and Kevin JohnsonScott Wright joins in as “god” during post-edit.  Below are the show notes, links to articles and news mentioned in the podcast:

  • New privacy settings in Facebook are rolling out, regional networks are being removed.  Be sure to check out the comments under Mark Zuckerberg’s blog post…all spam!
  • Is Facebook photo tagging still a big fail?
    Scott clarifies this for us.  The solution to this is to adjust your privacy settings to allow only you to see tagged photos of yourself and ensure email alerting is on to alert you when a new photo is tagged of you.  That way you can easily remove any tagged photo of you.  There is also no way to “prevent” a photo of you being tagged.  However, to tag someone they need to be in your friends list.  How about false tagging?  Someone tagging you in a naughty picture…reputation issue?  What if you don’t have a Facebook account and friends make comments regardless?
  • Police create fake Facebook account to bust a college student for underage drinking.  Did the police go too far or this is acceptable practice in this day and age?
  • Kevin talks about Clickjacking.  What is it and what do users of social networks need to be aware of?

Please send any show feedback to feedback [aT] socialmediasecurity.com or comment below.  You can also call our voice mail box at 1-613-693-0997 if you have a question for our Q&A section on the next episode.  You can also subscribe to the podcast in iTunes! Thanks for listening!

Social Media Security Podcast 5 – Google Reader, Privacy, Wave, ChromeOS and Foursquare

skullThis is the 5th episode of the Social Media Security Podcast recorded November 20, 2009.  This episode was hosted by Scott Wright and Tom Eston. Kevin Johnson will be joining us for the next podcast.  Below are the show notes, links to articles and news mentioned in the podcast:

Please send any show feedback to feedback [aT] socialmediasecurity.com or comment below.  You can also call our voice mail box at 1-613-693-0997 if you have a question for our Q&A section on the next episode.  You can also subscribe to the podcast in iTunes! Thanks for listening!

1 2 3 4