scott – The Social Media Security Podcast

Social Media Security Website and Podcast Reloaded!

Posted under Site News on September 25th, 2012 by Tom

Since 2009, I’ve been maintaining the popular Facebook Privacy & Security Guide that has been used by several universities and government agencies as well as regular users of Facebook. If you’re not familiar with my guide, it’s a simple two page handout that walks you through recommended privacy and security settings for your Facebook profile.

The guide has been a labor of love but also required frequent updates since Facebook has drastically changed the privacy controls as well as the layout within the Facebook platform over the years. Needless to say it’s been tough to keep the guide updated and also tough to keep it to a single page so that it can be easily distributed. Today, I’m happy to announce that my company SecureState is now officially sponsoring the guide so that it can be maintained with frequent updates! Having said that, I’m announcing today the release of the fourth version of the Facebook Privacy & Security Guide, updated with the latest information on Facebook’s privacy and security settings. Please download and distribute to friends and family.

Also around the same time I started the guide, I started the Social Media Security website and podcast. The podcast is still being recorded monthly and co-hosted by myself and Scott Wright. Today we also released our 30^th episode along with a website redesign for socialmediasecurity.com. I’d like to thank the podcast’s new sponsor SecureState for the new design and support of the podcast. Special thanks go to DigiP over at Tick Tock Computers for putting together a great site redesign and logo. I look forward to recording more podcasts and getting the word out on how to safely use social media!

Security pros use layered techniques, but so do attackers

Posted under Contributors, Facebook, Social Media, Social Networking on March 23rd, 2010 by Scott Wright

For many years security professionals have advocated using layered safeguards to reduce the risk of threats. While many organizations do employ multiple technologies like firewalls, anti-virus and intrusion detection to try to stop hackers, these guys are getting very good at navigating our layers of security. It’s like the old Mario and Donkey Kong video games where you had to jump over land mines, climb ladders, wait for doors to open and avoid swinging obstacles to reach the bonus prizes.

As an example of how many layers they are able to traverse, consider the reported attack on a financial institution’s enterprise network, which started life as a hacked Facebook account. (Click HERE for the full story.)

To make a long story short the attackers did the following:

They captured the Facebook credentials of an individual who worked for a financial institution
They then scanned the user’s Facebook profile to find recent social events involving co-workers on Facebook (finding a company picnic)
They then sent emails to multiple Facebook friends who were co-workers saying, “Hey, have a look at the pictures I took at the company picnic!”
The emails contained links to malicious web pages that attempted to launch a keylogger on the victims’ computers.
They then scanned the keystrokes of an employee whose laptop had become infected with the keylogger and found the authentication credentials for the corporate VPN
They infiltrated the VPN and infected a computer inside the corporate perimeter and performed vulnerability scans around the network to find servers with sensitive information on them.

The attack lasted as long as 2 weeks. If the attackers’ vulnerability scans had not been so “noisy”, they may not have been noticed, and the company could have suffered severe losses in terms of costly data breaches and corrupted databases, as well as system repairs.

So, what will happen now? Will the company add another layer of security to prevent a similar attack in the future? Probably… and these attackers will probably move on to other organizations with a bit less security. The cat and mouse game continues.

What’s interesting in this story is that the initial attack on the employees’ Facebook friends is pretty hard to defend against, since nothing seemed out of the ordinary. There really was a corporate picnic!

What would you do next if you were a security manager at this financial institution?