Social Media Security Podcast 39 – Snapcash, Yik Yak, LinkedIn Security and Privacy Tips

socialmediasec-avatar-80x78This is the 39th episode of the Social Media Security Podcast sponsored by SecureState and the Streetwise Security Zone.  This episode was hosted by Tom EstonScott Wright recorded December 12, 2014.  Below are the show notes, links to articles and news mentioned in the podcast:

  • Snapcash” has been announced by the creators of Snapchat. Can Snapchat gain enough consumer confidence to break into the payments field?
  • Yik Yak is a social app for browsing anonymous chats in your locale and it’s gaining popularity with teens and causing some problems for schools.
  • Yik Yak is also not as private or anonymous as you think as a new security vulnerability was just disclosed!
  • How to opt out of Twitter’s new app tracking feature
  • Facebook’s updated Privacy Policy? Not much new, but policies have been reworded to be somewhat less onerous to read
  • Facebook At Work – Will it work?
  • Scott and Tom share our opinions on the big Sony Pictures security breach
  • Scott shares some best practices on how to secure your LinkedIn account. Tom shares some good tips to make your LinkedIn account more private. Here are a few of the tips we discussed:
  • 1) Turn on HTTPS for all sessions:
    – Check the “Secure Connections” box in the security settings page

    2) Turn on Two-Step Verification

    – The security settings page will tell you whether or not two-step verification is already set up
    – You can turn it on, and provide a mobile phone where SMS messages will be sent

    Both are accessible by doing the following while logged in to your LinkedIn account on the Web:

    a) Hover the mouse cursor over your profile picture

    b) Click on the Account tab in the bottom left of the page

    c) Click on “Manage Security Settings”

Please send any show feedback to feedback [aT] socialmediasecurity.com or comment below.  You can also call our voice mail box at 1-613-693-0997 if you have a question for our Q&A section on the next episode.  Don’t forget  to subscribe to the podcast in iTunesfollow us on Twitter and like us on Facebook.  Thanks for listening!

 

Social Media Security Podcast 38 – Corporate Policy, Whisper Privacy Flaws, Snapchat Hack

socialmediasec-avatar-80x78This is the 38th episode of the Social Media Security Podcast sponsored by SecureState and the Streetwise Security Zone.  This episode was hosted by Tom EstonScott Wright recorded October 21, 2014.  Below are the show notes, links to articles and news mentioned in the podcast:

Please send any show feedback to feedback [aT] socialmediasecurity.com or comment below.  You can also call our voice mail box at 1-613-693-0997 if you have a question for our Q&A section on the next episode.  Don’t forget  to subscribe to the podcast in iTunesfollow us on Twitter and like us on Facebook.  Thanks for listening!

Social Media Security Podcast 33 – Heartbleed, Hashtag Fail, Social Impersonation

Guess what? We’re back!  This is the 33rd episode of the Social Media Security Podcast sponsored by SecureState.  This episode was hosted by Tom Eston and Scott Wright recorded May 15, 2014.  Below are the show notes, links to articles and news mentioned in the podcast:

Please send any show feedback to feedback [aT] socialmediasecurity.com or comment below.  You can also call our voice mail box at 1-613-693-0997 if you have a question for our Q&A section on the next episode.  Don’t forget  to subscribe to the podcast in iTunesfollow us on Twitter and like us on Facebook.  Thanks for listening!

Social Media Security Podcast 32 – The Privacy Paradox, Twitter Hacks, Facebook Home

avatarThis is the 32nd episode of the Social Media Security Podcast sponsored by SecureState.  This episode was hosted by Tom Eston and Scott Wright recorded April 25, 2013.  Below are the show notes, links to articles and news mentioned in the podcast:

Please send any show feedback to feedback [aT] socialmediasecurity.com or comment below.  You can also call our voice mail box at 1-613-693-0997 if you have a question for our Q&A section on the next episode.  You can also subscribe to the podcast in iTunesfollow us on Twitter and like us on Facebook.  Thanks for listening!

Social Media Security Podcast 30 – The Password Episode

This is the 30th episode of the Social Media Security Podcast sponsored by SecureState.  This episode was hosted by Tom Eston and Scott Wright.  In this episode we talk about the password problem and why we continue to choose easy to guess passwords.  Tom and Scott also talk about ways to select more secure passwords and how technology can help.  Below are the show notes, links to articles and news mentioned in the podcast:

The password Episode!  It’s episode 30!

Major password breaches in the last few months:
Brute force attacks on passwords is the #1 way we break into companies during pentests! Want to see the poor passwords people choose? SkullSecurity has very good lists from previous breaches.  Looking for more information? Tom wrote a white paper on how easy it is to profile user passwords on social networks.
The password problem.  Users continue to make poor password choices. Why? 
  • Too many to remember?
    • It’s easier to use the same password for each site
    • Also the same user id and email
  • Failures in user awareness?
  • Users are not provided the technology to help
  • Social networks and other sites make it easy to choose weak passwords, little adoption of two factor authentication because users will complain
  • Mobile apps are not designed to constantly enter passwords.  This is why you “stay logged in”.
Worse case scenario?
What is the solution?
Please send any show feedback to feedback [aT] socialmediasecurity.com or comment below.  You can also call our voice mail box at 1-613-693-0997 if you have a question for our Q&A section on the next episode.  You can also subscribe to the podcast in iTunes and follow us on Twitter.  Thanks for listening!

Social Media Security Podcast 28 – Facebook Timeline, US Privacy Questions, Twitter Acquisitions

This is the 28th episode of the Social Media Security Podcast recorded back a few months ago.  Content is still relevant! :-) This episode was hosted by Tom Eston and Scott Wright.  Below are the show notes, links to articles and news mentioned in the podcast:

Don’t worry! We are still planning on getting back to regular podcasts.  Stay tuned.  Please send any show feedback to feedback [aT] socialmediasecurity.com or comment below.  You can also call our voice mail box at 1-613-693-0997 if you have a question for our Q&A section on the next episode.  You can also subscribe to the podcast in iTunes and follow us on Twitter.  Thanks for listening!

 

The race for the most personal Twitter followers

I have had a great reply on this topic while going around the USA talking about social media security.  During my talk I give an example of why it is NOT okay to allow just anyone the right to follow you or vise versa.

I choose a volunteer out of the crowd.  Usually a nice looking woman because…why not.  I give a hypothetical situation.  We were dating and things are starting to get serious.  So serious that I take her to meet my mom for the first time. While we are at my ma’s house, I introduce her to my new brother-in-law.  My brother-in-law was in charge of bringing the dinner rolls and once again forgot.  He asks her to go to the Italian (not french) bakery down the road with him to get these rolls.  She says yes.  While they are picking up the rolls he notices that he forgot his wallet and asked her for $4.98 to cover the rolls.  She just happens to have $5.00 in her left pocket.

Would she give him the $5.00 and why?

The answer has always been “yes” and because he is associated or was introduced to her by me.  There is an applied level of trust set prior to them going to the bakery.  Well this level of trust in my opinion can be accomplished within twitter.  If I follow you and we start having a friendly conversation(your favorite sports team) I will then go after your friends and family for a small amount to help me with my “cure/run/walk”.  All I have to do is introduce myself as your friend as they can see our past conversations in twitter.  I  have had a over 90% success rate of getting their followers to click my cause link.  This success is based on the applied trust between two strangers.  So although it is really #kwel to have 70,000 twitter followers it can also cost your friends and family $4.98

For more information feel free…info@unixbox.ws

Firesheep’s Revenge

No, this is not an article on the new version or even newly added super hero features for firesheep? #titlefail? Maybe but please read on then decide.

I know firesheep has lost its shiny coin syndrome with most but the attack is still working quite well in the field.  While the readers/listeners have been doing a good job of enabling secure browsing options in Twitter and Facebook, we still have a long way to go. Please keep spreading the word and keep pleading to social networking sites to enable secure browsing by default.  So, Why the “Firesheep’s Revenge” title?  Well these last month’s, a couple of us have been testing common social media monitoring (SMM) tools.  These tools are generally used by small businesses, internal marketing, or external marketing companies to help update social media accounts without the hassle of logging into every social networking site individually.  We have been testing these SSM’s and found that:

http://hootsuite.com/dashboard#
http://sproutsocial.com/dashboard
http://standard.cotweet.com/channels#

Are not using secure browsing by default, allowing us to hijack sessions.  What does this mean? Well by adding your social media accounts into these SMM tools, you are granting the tool permission or full control over that account(s). By gaining control over the tool we are bypassing all the hard work you did by enabling secure browsing in each of your twitter and facebook accounts.  Try explaining to the VP of Marketing that even though you checked the “defeat firesheep” box it still works. And not only will it work on Facebook/Twitter but now LinkedIn, Foursquare, ping.fm and Ning accounts all in one interface. Most of the time we were looking at full access to the corporations social media strategy. So, we are right back to where we started, teaching the user that security is usually the last thing on the mind of these rapid development firms. If you do not see the option of “secure browsing”, then please be careful of where you update your social media accounts. Ask your tool makers where this option is located.  If they do not have this option then maybe you should look for another tool.

James F. Ruffer III
Unixbox
@jruffer

1 2 3 8