I’ve finally updated the Facebook Privacy & Security Guide to version 3.0. This is a major revision which includes directions on how to set the latest privacy and security controls in Facebook. Maintaining this guide has been challenging over the last year as Facebook has made major changes multiple times in regards to the way privacy settings are enabled. Having said that, this is a great time to use my guide and review what your privacy settings are. Things like enabling secure browsing, login approvals and limiting the audience to what you post are more important then ever.
As always, feel free to distribute this guide to friends and family! Happy Thanksgiving!
As I have been testing the security settings of companies social media strategies, I have consistently noticed two things, marketing is desperately trying to find its ROI and IT/Security doesn’t even know they have a FB page. I do agree that after a number of months, it is time to show the CFO that spending that insame amount of time on their social media sites is worth the payroll checks. Unfortunately, analytics alone have been a blurry way of making that compelling argument and can be defeated by saying, if, I had put those payroll checks into google…I could see our ROI in a nice neat report. This is one of the reasons that marketing is jumping head first into technologies like Shoutlet, payvment or others (FB E-commerce). Why not sell your items on your FB Page? Your team has worked extremely hard to get thousands of new users to click follow/like. Ultimately, this is going to be the future of pages but because IT/Security is not involved in the social media process it also opens a HUGE GAPPING HOLE in your security policy and procedures. And of course here is your example:
The policy of company ACME is “no social networking allowed” on internal networks. Sites are being blocked at the firewall with rules and enforced with a content filtering tool. IT/Security has done its job with social media, right? BUT an exception is made for Marketing because they are special people. A FB page was created as well as an E-Commerce app installed without consulting IT/Security. I know this because after taking over the FB page using our friends Cain and Able, I replaced just one of the “buy now” buttons to redirect it my site and used analytics to see how many people clicked this button. Showing this to Director of IT he replied “I didn’t even know we had a FB Page.”
After this meeting we agreed to stop and allow IT/ Security to be a part of the implementation of this new e-com solution and lock down this new site. After a couple of months we were given the green light that all social media was secure and our attacks would now #fail. Well they were wrong! Here is what happened; Technology constantly changes and therefor we should also be constantly training/testing these changes. Yes, all https was checked. Yes, they read www.socialmediasecurity.com on a regular basis. But they forgot to monitor their social media accounts like they would an email server. There is still a core failure in my opinion of Facebook pages. Who?!? owns the data and when is it okay to monitor the admins personal accounts? Because these users of the pages still enjoy using Facebook for personal use. They do not apply the corporate rules to their personal accounts nor should they if that is how they live. So, we are either forced to create fake accounts or all share one admin account. Well with our testing we are still targeting the admins of these pages. There are many many ways to gain access to their accounts and once in, we only have to create our own evil twin account to keep access. Example: if Bob Alice is the admin of the page just create another Bob Alice and copy the information including the profile imagine and allow this new user admin rights to the page. Most common users will just think this is a Facebook glitch and it is showing their profile twice. But in reality it is a way for us to keep a constant admin account to this system. If you maintain a Facebook page you know that admins just lose their rights to the page all the time out of the blue. So constantly adding the same person is a regular process. If the company was monitoring its data it would see these changes or see that there were in fact 2 different accounts attached to this page. But we are not monitoring these accounts, yet. Social media security can be a full time job depending on the risk and frequency of the sites. For more information feel free as always to email me. email@example.com
Kevin Johnson and Tom Eston gave the third and final “Social Zombies” talk at Notacon 8 this weekend. This talk focused on how social networks are using geolocation and the abuse of location based services.
“Social networks have jumped onto the geolocation bandwagon with location-based tweets, status updates, check-ins, mayorships, and more. This doesn’t take into account EXIF, QR codes, and advancements in HTML 5 geo implementations, which are being built into these location-based services. This is often implemented and enabled without the user even knowing it. In fact, geolocation is one of the hottest technologies being used in everything from web browsers to mobile devices. As social networks throw our location coordinates around like candy, its only natural that bad things will happen and abuse will become more popular. This presentation will cover how social networks and other websites are currently using location-based services, what they plan on doing with it, and a discussion on the current privacy and security issues. We will also discuss the latest geolocation hacking techniques and will release custom code that can abuse all of the features being discussed.”
The Facebook Privacy & Security Guide has been updated to version 2.1 to reflect recent changes that Facebook has made. Updates to the guide include minor changes to the privacy navigation structure and details on the new “Instant Personalization” privacy setting. Also, I included information on Facebook Ads. Please print it out for your own use or share with friends and family! Questions and comments can be posted here or sent to feedback[aT]socialmediasecurity.com.
I recently co-authored an article with Jennifer Leggio from ZDNet on the Fifteen significant social media & security events of 2009. Be sure to check it out as there were *many* high profile attacks on social networks and their users this year. The article also provides a preview of what we might see in 2010. Thanks again to Jennifer for putting this article together!
The video clocks in at about 18 minutes. I also included information about email/text alerts, how applications work, Facebook Ads, and how to hide your friends list from public searches. Stay tuned for other guides and videos for MySpace, Twitter and LinkedIn.
I have updated and released version 2.0 of the popular Facebook Privacy & Security Guide. Version 2.0 reflects the recent changes that Facebook made to it’s privacy settings. In addition, I added a new section titled “Blocking and Creating Friend Lists” and expanded on how your Name, Profile Picture, Gender, Current City, Networks, Friend List, and Pages are now publicly available information.
Can you remove public access to your friend list?
One tip I didn’t have room for in the guide around these new changes is the following. You can remove the ability for your “Friend List” to be viewed in public searches by selecting the Edit “pencil” in the Friends box on your profile page and unchecking the box. Here is a screen shot of this. Unfortunately, this control is all or nothing but the good news is your Friends can still see your friends list. You may also want review your application settings so application “boxes” are not showing on your public profile as well. More information can be found on Facebook’s blog post about these issues (hat tip to @mubix for pointing this out).
Like before please send any feedback on the guide to feedback[ aT ]socialmediasecurity.com. The companion video is being worked and should be up shortly as well.
Today, a credit union in St. Louis, MO called Vantage Credit Union announced that they are offering a service through Twitter called tweetMyMoney to conduct online banking. Banking credentials, PINs and account information are not passed through tweets made via direct message to the @myvcu Twitter account (from the FAQ listed on the bank’s website), only commands to get account balance, recent transactions, etc.
However, there are a few potential security issues/concerns with this type of service. While it seems that VCU has made this system with good intentions, most of these concerns center around the fact that you are putting in requests for account information and even transferring money to other accounts through Twitter which is a third-party service not owned or managed by the bank.
Plain and simple, Twitter is a third-party service. When you send a direct message (DM) to another Twitter user this message is stored on Twitter’s servers. Not the banks. The bank is simply retrieving these messages. You should never have any expectation of privacy from DMs *at all*. Sure, they are “private” to you and the user you are sending it to but think about who on Twitter’s end might be able to view these DMs. Remember, security at Twitter is not very important currently as we have seen severaltimes in very recent history.
What about the scenario of a local “man-in-the-middle” attack where someone could be sniffing your network traffic to modify your banking requests? A simple attack like this could easily compromise the users Twitter account. Guess what, people like to reuse user id’s and passwords…we all know where that could lead to. I am not sure if they are using any form of two-factor authentication for their online banking application so you may only need a login id and password to access a compromised online banking account. Again, not sure this is the case with VCU but yes, some banks are still using single factor authentication!
How about the security of the @myvcu Twitter account you send your direct messages to? Attackers *will* target this account, it’s only a matter of time. You are trusting that the folks at VCU are properly securing this account and there are no vulnerabilities or exploits on the Twitter site to compromise the account as well. It also looks like this account is used for communicating with customers…it could be possible that these credentials could be phished and/or compromised through multiple avenues of attack.
I question thecorrespondence authentication codes that they have put in place. Relying on the user to change these multiple codes is an interesting choice. I could see this being spoofed quite easily.
Lastly, the users of this system could also be targeted if say a user accidentally tweeted something like “#l5d 7” to their followers instead of by DM (known as #dmfail)? Attackers can easily script a bot to look for these patterns and target these users.
I don’t want to knock the folks at VCU as it seems that they are a very “progressive” bank and it looks like they want to push the envelope of new technology. My opinion is that it just seems that there are too many points of security “fail” in this system. Potential failures in the Twitter service, @myvcu account and Twitter users of the VCU system in addition to the third-party privacy concerns all make for something that you shouldn’t be trusting your online banking to. Social networks are not for online banking in any form…srsly.