Privacy – The Social Media Security Podcast

The New Facebook Graph Search: How to Protect Your Privacy

Posted under Facebook, Open Graph, Privacy on March 19th, 2013 by Tom

Over the last several months, Facebook has been making significant design and UI changes. Besides the newsfeed changes announced several weeks ago, Facebook has recently begun rolling out a large change in the way you search for information through the platform. While this feature is still in “beta” status, you can tell if you have the new Graph Search by looking at the top left side of your Facebook profile (Figure 1). You will see a search area called “Search for people, places and things”.

Figure 1 – Location of the Facebook Graph Search on Your Profile Page

The Facebook Graph Search is a new implementation of search which retrieves information that comes from Facebook’s Graph. This new feature brings powerful capabilities for finding out more about your friends’ “likes” and activities. It also provides attackers with a more efficient way to glean information for social engineering attacks and other intelligence gathering activities.

What’s the Facebook Graph?

Think of the Facebook Graph as a very large database of personal information from (literally) a billion Facebook users. This information is categorized by what you and your friends like as well as what you’ve posted, what’s in your profile, locations you’ve visited, and tagged pictures. The Facebook Graph has evolved over the years in order to correlate as much information as possible, making it very easy to search.

What’s the Privacy Concern?

The issue is that anything you’ve ever posted publically, “Liked,” or were ever tagged in can be quickly searched. Additionally, other information that you’ve posted in your profile, such as your hometown, relationship status, and employer now become searchable. For example, those party pictures you were tagged in four years ago doing things you would never do anymore can be searched by your friends and possibly the friends of your friends; or worse, anyone with a Facebook account.

The Graph Search opens up lots of new and interesting search possibilities that we’ve yet to see on a social network. Here’s one example: Suppose you are a single male looking for single females. You can simply search for “photos of friends of my friends who are single and female” and find pictures of all the single females that are friends of your friends. Interesting, huh? How about the intelligence gathering aspects of these types of searches? For example, search for “<Insert Company> employees located in <Insert City> and you will have a list of targets for social engineering or more. For some other eye opening searches, I recommend you read this blog which shows some interesting privacy ramifications of creative searches.

How to Protect Your Privacy

First, check out Facebook’s “Activity Log” (Figure 2) which can be found under Privacy Settings and Tools in your Privacy Settings.

Figure 2 – Location of Facebook’s Activity Log

Next, if you want to change the privacy settings for all posts you’ve shared with Friends of Friends or with the Public, you can select “Limit Past Posts,” which will automatically change the privacy settings on all past posts (Figure 3).

Figure 3 – Selecting “Limit Past Posts” changes privacy settings for all posts set to Friends of Friends or Public

You will also want to make sure you review the following items in your Activity Log (Figure 4): Your Posts (especially those set to Public or Friends of Friends), Posts You’re Tagged In, Posts by Others, and Your Photos. It doesn’t hurt to also review your Likes to make sure there is nothing you liked that you don’t want coming up in a search.

Figure 4 – Items to Review in Your Activity Log

Lastly, carefully review your Facebook Privacy settings especially if you haven’t looked at them in a while. The Facebook Graph Search makes these settings more important than ever. Be sure to download SecureState’s recently revised Facebook Privacy & Security Guide which walks you through the recommended privacy settings while still allowing you to be social. The updated guide includes details on Facebook Graph Search and other important privacy settings. I encourage you to share this guide with friends and family.

Looking For More Information on Social Media Privacy?

SecureState has just released a comprehensive whitepaper by Ken Smith of SecureState’s Profiling & Penetration Team entitled “The Problem with Privacy”. I highly recommend you download and read this whitepaper to find out what the latest threats to your privacy are when using Social Media.

Cross-Posted from the SecureState Blog

Facebook Privacy and Security Article on ConsumerReports

Posted under Facebook, Privacy on May 3rd, 2012 by Tom

I wanted to pass along a really good article on Facebook Privacy that was released on ConsumerReports.org. There are some good quotes from others in the security and privacy community including Kevin Johnson and Ed Skoudis. Check out the article here:

http://www.consumerreports.org/cro/magazine/2012/06/facebook-your-privacy/index.htm

Facebook Privacy & Security Guide Updated to v3.0

Posted under Facebook on November 24th, 2011 by Tom

I’ve finally updated the Facebook Privacy & Security Guide to version 3.0. This is a major revision which includes directions on how to set the latest privacy and security controls in Facebook. Maintaining this guide has been challenging over the last year as Facebook has made major changes multiple times in regards to the way privacy settings are enabled. Having said that, this is a great time to use my guide and review what your privacy settings are. Things like enabling secure browsing, login approvals and limiting the audience to what you post are more important then ever.

As always, feel free to distribute this guide to friends and family! Happy Thanksgiving!

Download v3.0 of the Facebook Privacy & Security Guide here

The race for the most personal Twitter followers

Posted under Contributors, Twitter on November 13th, 2011 by jruffer

I have had a great reply on this topic while going around the USA talking about social media security. During my talk I give an example of why it is NOT okay to allow just anyone the right to follow you or vise versa.

I choose a volunteer out of the crowd. Usually a nice looking woman because…why not. I give a hypothetical situation. We were dating and things are starting to get serious. So serious that I take her to meet my mom for the first time. While we are at my ma’s house, I introduce her to my new brother-in-law. My brother-in-law was in charge of bringing the dinner rolls and once again forgot. He asks her to go to the Italian (not french) bakery down the road with him to get these rolls. She says yes. While they are picking up the rolls he notices that he forgot his wallet and asked her for $4.98 to cover the rolls. She just happens to have $5.00 in her left pocket.

Would she give him the $5.00 and why?

The answer has always been “yes” and because he is associated or was introduced to her by me. There is an applied level of trust set prior to them going to the bakery. Well this level of trust in my opinion can be accomplished within twitter. If I follow you and we start having a friendly conversation(your favorite sports team) I will then go after your friends and family for a small amount to help me with my “cure/run/walk”. All I have to do is introduce myself as your friend as they can see our past conversations in twitter. I have had a over 90% success rate of getting their followers to click my cause link. This success is based on the applied trust between two strangers. So although it is really #kwel to have 70,000 twitter followers it can also cost your friends and family $4.98

For more information feel free…info@unixbox.ws

Taking over the Facebook Page “buy now” button (Part 2 of 2)

Posted under Contributors, Facebook on November 13th, 2011 by jruffer

As I have been testing the security settings of companies social media strategies, I have consistently noticed two things, marketing is desperately trying to find its ROI and IT/Security doesn’t even know they have a FB page. I do agree that after a number of months, it is time to show the CFO that spending that insame amount of time on their social media sites is worth the payroll checks. Unfortunately, analytics alone have been a blurry way of making that compelling argument and can be defeated by saying, if, I had put those payroll checks into google…I could see our ROI in a nice neat report. This is one of the reasons that marketing is jumping head first into technologies like Shoutlet, payvment or others (FB E-commerce). Why not sell your items on your FB Page? Your team has worked extremely hard to get thousands of new users to click follow/like. Ultimately, this is going to be the future of pages but because IT/Security is not involved in the social media process it also opens a HUGE GAPPING HOLE in your security policy and procedures. And of course here is your example:

The policy of company ACME is “no social networking allowed” on internal networks. Sites are being blocked at the firewall with rules and enforced with a content filtering tool. IT/Security has done its job with social media, right? BUT an exception is made for Marketing because they are special people. A FB page was created as well as an E-Commerce app installed without consulting IT/Security. I know this because after taking over the FB page using our friends Cain and Able, I replaced just one of the “buy now” buttons to redirect it my site and used analytics to see how many people clicked this button. Showing this to Director of IT he replied “I didn’t even know we had a FB Page.”

Part 2

After this meeting we agreed to stop and allow IT/ Security to be a part of the implementation of this new e-com solution and lock down this new site. After a couple of months we were given the green light that all social media was secure and our attacks would now #fail. Well they were wrong! Here is what happened; Technology constantly changes and therefor we should also be constantly training/testing these changes. Yes, all https was checked. Yes, they read www.socialmediasecurity.com on a regular basis. But they forgot to monitor their social media accounts like they would an email server. There is still a core failure in my opinion of Facebook pages. Who?!? owns the data and when is it okay to monitor the admins personal accounts? Because these users of the pages still enjoy using Facebook for personal use. They do not apply the corporate rules to their personal accounts nor should they if that is how they live. So, we are either forced to create fake accounts or all share one admin account. Well with our testing we are still targeting the admins of these pages. There are many many ways to gain access to their accounts and once in, we only have to create our own evil twin account to keep access. Example: if Bob Alice is the admin of the page just create another Bob Alice and copy the information including the profile imagine and allow this new user admin rights to the page. Most common users will just think this is a Facebook glitch and it is showing their profile twice. But in reality it is a way for us to keep a constant admin account to this system. If you maintain a Facebook page you know that admins just lose their rights to the page all the time out of the blue. So constantly adding the same person is a regular process. If the company was monitoring its data it would see these changes or see that there were in fact 2 different accounts attached to this page. But we are not monitoring these accounts, yet. Social media security can be a full time job depending on the risk and frequency of the sites. For more information feel free as always to email me. info@unixbox.ws

Firesheep’s Revenge

Posted under Facebook, Google Buzz, LinkedIn, Social Media, Social Networking, Twitter, Uncategorized on May 2nd, 2011 by jruffer

No, this is not an article on the new version or even newly added super hero features for firesheep? #titlefail? Maybe but please read on then decide.

I know firesheep has lost its shiny coin syndrome with most but the attack is still working quite well in the field. While the readers/listeners have been doing a good job of enabling secure browsing options in Twitter and Facebook, we still have a long way to go. Please keep spreading the word and keep pleading to social networking sites to enable secure browsing by default. So, Why the “Firesheep’s Revenge” title? Well these last month’s, a couple of us have been testing common social media monitoring (SMM) tools. These tools are generally used by small businesses, internal marketing, or external marketing companies to help update social media accounts without the hassle of logging into every social networking site individually. We have been testing these SSM’s and found that:

http://hootsuite.com/dashboard#
http://sproutsocial.com/dashboard
http://standard.cotweet.com/channels#

Are not using secure browsing by default, allowing us to hijack sessions. What does this mean? Well by adding your social media accounts into these SMM tools, you are granting the tool permission or full control over that account(s). By gaining control over the tool we are bypassing all the hard work you did by enabling secure browsing in each of your twitter and facebook accounts. Try explaining to the VP of Marketing that even though you checked the “defeat firesheep” box it still works. And not only will it work on Facebook/Twitter but now LinkedIn, Foursquare, ping.fm and Ning accounts all in one interface. Most of the time we were looking at full access to the corporations social media strategy. So, we are right back to where we started, teaching the user that security is usually the last thing on the mind of these rapid development firms. If you do not see the option of “secure browsing”, then please be careful of where you update your social media accounts. Ask your tool makers where this option is located. If they do not have this option then maybe you should look for another tool.

James F. Ruffer III
Unixbox
@jruffer

Social Zombies Gone Wild: Totally Exposed and Uncensored

Posted under Facebook, Geolocation, Privacy, Social Media, Social Networking, Twitter on April 18th, 2011 by Tom

Kevin Johnson and Tom Eston gave the third and final “Social Zombies” talk at Notacon 8 this weekend. This talk focused on how social networks are using geolocation and the abuse of location based services.

“Social networks have jumped onto the geolocation bandwagon with location-based tweets, status updates, check-ins, mayorships, and more. This doesn’t take into account EXIF, QR codes, and advancements in HTML 5 geo implementations, which are being built into these location-based services. This is often implemented and enabled without the user even knowing it. In fact, geolocation is one of the hottest technologies being used in everything from web browsers to mobile devices. As social networks throw our location coordinates around like candy, its only natural that bad things will happen and abuse will become more popular. This presentation will cover how social networks and other websites are currently using location-based services, what they plan on doing with it, and a discussion on the current privacy and security issues. We will also discuss the latest geolocation hacking techniques and will release custom code that can abuse all of the features being discussed.”

Slides are on SlideShare below:

Social Zombies Gone Wild: Totally Exposed and Uncensored

View more presentations from agent0x0

Facebook Privacy & Security Guide Updated to v2.3

Posted under Facebook, Privacy, Social Media, Social Networking on August 23rd, 2010 by Tom

Just a quick post that I have updated the Facebook Privacy & Security Guide to include information on configuring the privacy settings for Facebook Places. You can find this on the first page under “Sharing on Facebook”. Stay tuned for more information on Facebook Places in the next day or so!

Download the updated Facebook Privacy & Security Guide here (pdf download).

1 2 3 Next »