I recently co-authored an article with Jennifer Leggio from ZDNet on the Fifteen significant social media & security events of 2009. Be sure to check it out as there were *many* high profile attacks on social networks and their users this year. The article also provides a preview of what we might see in 2010. Thanks again to Jennifer for putting this article together!
Vote for Inherent Dangers of Real-Time Social Networking panel at #SXSW
We were happy to see that one of the panels up for selection at the South by Southwest (SXSW) Interactive Festival next year (March 12-16, 2010) is a panel about the security of social networks called “Inherent Dangers of Real-Time Social Networking”. The way panel selections work st SXSW is that they are up for open voting which ends on September 4th. Basically the voting works like this (from the SXSW site):
“SXSW is a community-driven event. So, knowing what kinds of topics you want to hear at the event next March is extremely important to us. Your voting accounts for about 30% of the decision-making process for any given programming slot.
Also important is the input of the SXSW Advisory Board, which is a group of industry professionals from across the US and around the world. The final part of the panel decision-making equation is the input of the SXSW staff.”
So yes, you have a big part in the selection process! This panel includes the following participants:
Jennifer Leggio (@mediaphyter), ZDNet
John Adams (@netik), Twitter operations and security incident response team
Damon Cortesi (@dacort), security consultant at Sevicron, founder of TweetStats, Twitter app developer
Mike Murray (@mmurray), CISO of Foreground Security
Awesome, awesome group for this panel. Here is the description of the panel (from the SXSW PanelPicker site):
“There’s plenty of chatter about social media and security issues, from social engineering to the naïveté of users. This panel of experts will explore how cyber criminals are taking advantage of socnets flaws and lack of user awareness, and what both individuals and companies can do to help protect themselves.”
Since this is one of the biggest media conferences of the year, we highly encourage you to vote for this panel. This will be one not to miss if selected! What are you waiting for? Go vote now!
Defeating MSPLinks on MySpace
The following post is a contribution from a researcher called “anti-social”:
A few years back MySpace implemented MSPLinks as a way to defeat spammers from posting their spam URL’s. The idea being that spammers couldn’t make money if they constantly had to buy new domains. The idea worked to a pretty good extent once MySpace finally figured out how to filter all the XSS vulnerabilites they had when sanitizing profiles.
About a year ago, MySpace added to MSPLinks a phishing warning screen to inform users that the site they were going to could possibly be malicious. This screen can be easily defeated by a simple post method with a hidden field. That’s because MSPLinks.com trusts post requests from MySpace.com.
A working example can be found at: http://www.myspace.com/socnetsec
If you click the 1st button under the “About Me” section, the phishing screen isn’t shown (IE and Safari takes you straight through to the link, Firefox pops up a warning asking if you want to post your data to MSPLinks)
If you click the 2nd button, you’ll notice that you’ll be taken to MySpace’s phishing window.
Here is the simple html code in the profile:
<form action="http://www.msplinks.com/MDFodHRwOi8vd3d3LnNvY2lhbG1lZGlhc2VjdXJpdHkuY29t" method="POST"><input type="submit" name="coolbutton" value="SETTING DISCHECK" /><input type="hidden" name="discheck" value="on" /></form><form action="http://www.msplinks.com/MDFodHRwOi8vd3d3LnNvY2lhbG1lZGlhc2VjdXJpdHkuY29t" method="GET"><input type="submit" name="coolbutton" value="NO DISCHECK" /></form>
What’s the point? Even with SPAM and URL filtering on social networks like MySpace…they can be easily bypassed. Since 2007 there have been many different ways to bypass MSPLinks (just do a Google search), this is just another method. Also, because social networks encourage user generated content, clicking on any links that are posted by the user can lead to bad things. Especially if they are already masked like they are via MSPLinks. MSPLinks have now become even more dangerous because you trust MySpace is filtering these links.
Hopefully, MySpace can come up with something better then MSPLinks as they are pretty much useless to fight SPAM and links to malware sites.
Sex Offenders in IL Banned from Social Networking Sites
There was an interesting post on Mashable today about a new law that was just passed in Illinois by the governor Pat Quinn. Basically, it bans sex offenders from using social networking sites. The problem is that social networking is so loosely defined that this could mean any news site or blog. Think about Facebook Connect or anything that shows a profile picture with media links and/or text. In addition, how would this stop a sex offender from using an alias and/or fake name on these sites (if you can even define what these sites are)?
There is some interesting conversation brewing around this one especially around the fact that just by peeing in public you are considered a sex offender in 13 states!
View proposed changes to the Facebook SRR/ToS
You can view and comment on changes to the Facebook SRR (Statement of Rights and Responsibilities or better known as “Terms of Service”) located on the Facebook Governance Page. You can download and review the redlined proposed changes here. The deadline for comment is 12pm PST August 18th. It is important for Facebook users to review these new terms as there are significant changes to the SRR and the wording that is used. Most of the SRR will affect your privacy as a Facebook user.
For example, make sure you note the following:
1. For content that is covered by intellectual property rights, like photos and videos (“IP content”), you specifically give us the following permission, subject to your privacy and application settings: you grant us a non‐exclusive, transferable, sub‐licensable, royalty free, worldwide license to use any IP content that you post on or in connection with Facebook (“IP License”). This IP License ends when you delete your IP content or your account (unless your content has been shared with others, and they have not deleted it).
3. When you add an application and use Platform, your content and information is shared with the application. We require applications to respect your privacy settings, but your agreement with that application will control how the application can use the content and information you share.
4. When you publish content or information using the “everyone” setting, it means that everyone, including people off of Facebook, will have access to that information and we may not have control over what they do with it.
You should already know these things though, right? 🙂 Remember: Anything you post to Facebook private or not…consider it public information. You can leave your comments on the Facebook Governance Page or feel free to comment here. We would love to hear your opinion of these upcoming changes.
Staying Safe & Secure on Twitter
We recently added a presentation that Tom Eston did at the Cool Twitter Conference in Cleveland last week to the presentations section. You can also find it on SlideShare. This presentation should give you some good tips on how to use Twitter safely. Stay tuned for a printable guide and video similar to the Facebook Privacy & Security Guide.
Tom was also interviewed by Dan Hanson from the Great Lakes Geek Show about his presentation as well as other social media security issues.
Twitter and Facebook DDoS was Targeted at One User
The following article was just posted over at CNET News regarding the massive DD0S (Distributed Denial of Service) that targeted Twitter, Facebook, LiveJournal and more.
Via CNET News:
A pro-Georgian blogger with accounts on Twitter, Facebook, LiveJournal and Google’s Blogger and YouTube was targeted in a denial of service attack that led to the site-wide outage at Twitter and problems at the other sites on Thursday, according to a Facebook executive.
New Research Released on Koobface
Today Trend Micro released probably the most comprehensive research yet on the Koobface social network worm. This research details how Koobface works, the malicious payloads it carries and how this worm has spread to all the major social networks. The most recent victim being Twitter. Most alarming is that Koobface will still continue to evolve and is the beginning of a new generation of malware targeting social networks.
Check out the article and download the PDF for the full report. We will also have this link posted in the “Research” section of the site.