socialmedia – The Social Media Security Podcast

Social Media Security Website and Podcast Reloaded!

Posted under Site News on September 25th, 2012 by Tom

Since 2009, I’ve been maintaining the popular Facebook Privacy & Security Guide that has been used by several universities and government agencies as well as regular users of Facebook. If you’re not familiar with my guide, it’s a simple two page handout that walks you through recommended privacy and security settings for your Facebook profile.

The guide has been a labor of love but also required frequent updates since Facebook has drastically changed the privacy controls as well as the layout within the Facebook platform over the years. Needless to say it’s been tough to keep the guide updated and also tough to keep it to a single page so that it can be easily distributed. Today, I’m happy to announce that my company SecureState is now officially sponsoring the guide so that it can be maintained with frequent updates! Having said that, I’m announcing today the release of the fourth version of the Facebook Privacy & Security Guide, updated with the latest information on Facebook’s privacy and security settings. Please download and distribute to friends and family.

Also around the same time I started the guide, I started the Social Media Security website and podcast. The podcast is still being recorded monthly and co-hosted by myself and Scott Wright. Today we also released our 30^th episode along with a website redesign for socialmediasecurity.com. I’d like to thank the podcast’s new sponsor SecureState for the new design and support of the podcast. Special thanks go to DigiP over at Tick Tock Computers for putting together a great site redesign and logo. I look forward to recording more podcasts and getting the word out on how to safely use social media!

Facebook Privacy & Security Guide Updated to v3.0

Posted under Facebook on November 24th, 2011 by Tom

I’ve finally updated the Facebook Privacy & Security Guide to version 3.0. This is a major revision which includes directions on how to set the latest privacy and security controls in Facebook. Maintaining this guide has been challenging over the last year as Facebook has made major changes multiple times in regards to the way privacy settings are enabled. Having said that, this is a great time to use my guide and review what your privacy settings are. Things like enabling secure browsing, login approvals and limiting the audience to what you post are more important then ever.

As always, feel free to distribute this guide to friends and family! Happy Thanksgiving!

Download v3.0 of the Facebook Privacy & Security Guide here

Taking over the Facebook Page “buy now” button (Part 2 of 2)

Posted under Contributors, Facebook on November 13th, 2011 by jruffer

As I have been testing the security settings of companies social media strategies, I have consistently noticed two things, marketing is desperately trying to find its ROI and IT/Security doesn’t even know they have a FB page. I do agree that after a number of months, it is time to show the CFO that spending that insame amount of time on their social media sites is worth the payroll checks. Unfortunately, analytics alone have been a blurry way of making that compelling argument and can be defeated by saying, if, I had put those payroll checks into google…I could see our ROI in a nice neat report. This is one of the reasons that marketing is jumping head first into technologies like Shoutlet, payvment or others (FB E-commerce). Why not sell your items on your FB Page? Your team has worked extremely hard to get thousands of new users to click follow/like. Ultimately, this is going to be the future of pages but because IT/Security is not involved in the social media process it also opens a HUGE GAPPING HOLE in your security policy and procedures. And of course here is your example:

The policy of company ACME is “no social networking allowed” on internal networks. Sites are being blocked at the firewall with rules and enforced with a content filtering tool. IT/Security has done its job with social media, right? BUT an exception is made for Marketing because they are special people. A FB page was created as well as an E-Commerce app installed without consulting IT/Security. I know this because after taking over the FB page using our friends Cain and Able, I replaced just one of the “buy now” buttons to redirect it my site and used analytics to see how many people clicked this button. Showing this to Director of IT he replied “I didn’t even know we had a FB Page.”

Part 2

After this meeting we agreed to stop and allow IT/ Security to be a part of the implementation of this new e-com solution and lock down this new site. After a couple of months we were given the green light that all social media was secure and our attacks would now #fail. Well they were wrong! Here is what happened; Technology constantly changes and therefor we should also be constantly training/testing these changes. Yes, all https was checked. Yes, they read www.socialmediasecurity.com on a regular basis. But they forgot to monitor their social media accounts like they would an email server. There is still a core failure in my opinion of Facebook pages. Who?!? owns the data and when is it okay to monitor the admins personal accounts? Because these users of the pages still enjoy using Facebook for personal use. They do not apply the corporate rules to their personal accounts nor should they if that is how they live. So, we are either forced to create fake accounts or all share one admin account. Well with our testing we are still targeting the admins of these pages. There are many many ways to gain access to their accounts and once in, we only have to create our own evil twin account to keep access. Example: if Bob Alice is the admin of the page just create another Bob Alice and copy the information including the profile imagine and allow this new user admin rights to the page. Most common users will just think this is a Facebook glitch and it is showing their profile twice. But in reality it is a way for us to keep a constant admin account to this system. If you maintain a Facebook page you know that admins just lose their rights to the page all the time out of the blue. So constantly adding the same person is a regular process. If the company was monitoring its data it would see these changes or see that there were in fact 2 different accounts attached to this page. But we are not monitoring these accounts, yet. Social media security can be a full time job depending on the risk and frequency of the sites. For more information feel free as always to email me. info@unixbox.ws

Firesheep’s Revenge

Posted under Facebook, Google Buzz, LinkedIn, Social Media, Social Networking, Twitter, Uncategorized on May 2nd, 2011 by jruffer

No, this is not an article on the new version or even newly added super hero features for firesheep? #titlefail? Maybe but please read on then decide.

I know firesheep has lost its shiny coin syndrome with most but the attack is still working quite well in the field. While the readers/listeners have been doing a good job of enabling secure browsing options in Twitter and Facebook, we still have a long way to go. Please keep spreading the word and keep pleading to social networking sites to enable secure browsing by default. So, Why the “Firesheep’s Revenge” title? Well these last month’s, a couple of us have been testing common social media monitoring (SMM) tools. These tools are generally used by small businesses, internal marketing, or external marketing companies to help update social media accounts without the hassle of logging into every social networking site individually. We have been testing these SSM’s and found that:

http://hootsuite.com/dashboard#
http://sproutsocial.com/dashboard
http://standard.cotweet.com/channels#

Are not using secure browsing by default, allowing us to hijack sessions. What does this mean? Well by adding your social media accounts into these SMM tools, you are granting the tool permission or full control over that account(s). By gaining control over the tool we are bypassing all the hard work you did by enabling secure browsing in each of your twitter and facebook accounts. Try explaining to the VP of Marketing that even though you checked the “defeat firesheep” box it still works. And not only will it work on Facebook/Twitter but now LinkedIn, Foursquare, ping.fm and Ning accounts all in one interface. Most of the time we were looking at full access to the corporations social media strategy. So, we are right back to where we started, teaching the user that security is usually the last thing on the mind of these rapid development firms. If you do not see the option of “secure browsing”, then please be careful of where you update your social media accounts. Ask your tool makers where this option is located. If they do not have this option then maybe you should look for another tool.

James F. Ruffer III
Unixbox
@jruffer

Social Zombies Gone Wild: Totally Exposed and Uncensored

Posted under Facebook, Geolocation, Privacy, Social Media, Social Networking, Twitter on April 18th, 2011 by Tom

Kevin Johnson and Tom Eston gave the third and final “Social Zombies” talk at Notacon 8 this weekend. This talk focused on how social networks are using geolocation and the abuse of location based services.

“Social networks have jumped onto the geolocation bandwagon with location-based tweets, status updates, check-ins, mayorships, and more. This doesn’t take into account EXIF, QR codes, and advancements in HTML 5 geo implementations, which are being built into these location-based services. This is often implemented and enabled without the user even knowing it. In fact, geolocation is one of the hottest technologies being used in everything from web browsers to mobile devices. As social networks throw our location coordinates around like candy, its only natural that bad things will happen and abuse will become more popular. This presentation will cover how social networks and other websites are currently using location-based services, what they plan on doing with it, and a discussion on the current privacy and security issues. We will also discuss the latest geolocation hacking techniques and will release custom code that can abuse all of the features being discussed.”

Slides are on SlideShare below:

Social Zombies Gone Wild: Totally Exposed and Uncensored

View more presentations from agent0x0

Why Should the CSO Care About an Employee’s Personal Social Media Account?

Posted under Contributors, Facebook, Social Media, Social Networking on March 29th, 2011 by jruffer

Thank you to Tom for allowing me to participate with social media security dot com. The guys in this community have been great resources in helping me to spread the word on the insecurities with social media. This year, I have been reaching beyond the security space, speaking to many social media clubs, podcampers and O’Reilly conferences only to realize something disheartening. Not enough people hear or are listening to us! I am going to start posting some real experiences to help with the questions of “why should I care about social media security?”

This week at Podcampnashville I was able to demo firesheep and in 3 mins and 48 secs, 64 accounts were in my sidebar waiting for me to double click. After the demo I had some great questions and just like that the session was over. Later a young lady came to me and admitted she was 1 of the 64 in the sidebar. She asked me to show her what I “could” of done with her account. She was not really impressed or scared that I could of updated the profile, chat with friends or add creepy users. Then fear came very quickly when I changed from the user account to the PAGES she had admin rights.

She is in charge of the facebook pages of 12 major medical practices in the area. I have to be honest she rocked at maintaining these pages. Impressed by her work, I asked how long she had into these pages and followers. Time was in the 1000’s of hours and also in the $100,000 range of billable time. My final question to her was…what would she do if all of this time and money came crashing down by some idiot at a camp running a free Moz Plug-in. She said she would hunt them down. She was kidding of course but I was a little scared to be honest. We went over some settings and she is now going to help spread the word. 1 out of 64 down.

Facebook Pages security is basically in the hands of the personal accounts of the admins. This is one reason why the CSO should care…

Things that make you go HMMMM? <- point to head -Arsenio Hall
Facebook terms and conditions state that you have to have a personal Facebook account to administrate your company page. Facebook company pages allow multiple users to have access to share content. Are you monitoring or making sure the people with access is meeting your company security standards? If an employee has left, is Facebook Page access part of the account removal process?

Facebook Privacy & Security Guide Updated to v2.1

Posted under Facebook on May 2nd, 2010 by Tom

The Facebook Privacy & Security Guide has been updated to version 2.1 to reflect recent changes that Facebook has made. Updates to the guide include minor changes to the privacy navigation structure and details on the new “Instant Personalization” privacy setting. Also, I included information on Facebook Ads. Please print it out for your own use or share with friends and family! Questions and comments can be posted here or sent to feedback[aT]socialmediasecurity.com.

Download the updated version of the Facebook Privacy & Security Guide

Security pros use layered techniques, but so do attackers

Posted under Contributors, Facebook, Social Media, Social Networking on March 23rd, 2010 by Scott Wright

For many years security professionals have advocated using layered safeguards to reduce the risk of threats. While many organizations do employ multiple technologies like firewalls, anti-virus and intrusion detection to try to stop hackers, these guys are getting very good at navigating our layers of security. It’s like the old Mario and Donkey Kong video games where you had to jump over land mines, climb ladders, wait for doors to open and avoid swinging obstacles to reach the bonus prizes.

As an example of how many layers they are able to traverse, consider the reported attack on a financial institution’s enterprise network, which started life as a hacked Facebook account. (Click HERE for the full story.)

To make a long story short the attackers did the following:

They captured the Facebook credentials of an individual who worked for a financial institution
They then scanned the user’s Facebook profile to find recent social events involving co-workers on Facebook (finding a company picnic)
They then sent emails to multiple Facebook friends who were co-workers saying, “Hey, have a look at the pictures I took at the company picnic!”
The emails contained links to malicious web pages that attempted to launch a keylogger on the victims’ computers.
They then scanned the keystrokes of an employee whose laptop had become infected with the keylogger and found the authentication credentials for the corporate VPN
They infiltrated the VPN and infected a computer inside the corporate perimeter and performed vulnerability scans around the network to find servers with sensitive information on them.

The attack lasted as long as 2 weeks. If the attackers’ vulnerability scans had not been so “noisy”, they may not have been noticed, and the company could have suffered severe losses in terms of costly data breaches and corrupted databases, as well as system repairs.

So, what will happen now? Will the company add another layer of security to prevent a similar attack in the future? Probably… and these attackers will probably move on to other organizations with a bit less security. The cat and mouse game continues.

What’s interesting in this story is that the initial attack on the employees’ Facebook friends is pretty hard to defend against, since nothing seemed out of the ordinary. There really was a corporate picnic!

What would you do next if you were a security manager at this financial institution?

1 2 Next »