Facebook Graph Search is an Awesome Tool for Phishing Attacks
Graph Search makes it easier for cybercriminals to gather relevant details that can be used to target phishing attacks more effectively.
Wed, January 16, 2013
PC World —
Slideshow: Facebook's New Graph Search
In a nutshell, Facebook Graph Search is a search engine that allows you to find things based on relationships and context--basically drawing from the limitless pool of Likes, tags, and check-ins posted by a billion Facebook members.
From a search perspective, Graph Search seems like a very powerful tool--something that makes search more personally relevant, and a concept that should have Google worried a bit. You can search based on people, places, friends, and interests. For example, you can do a search for "friends who like The Beatles and live in Chicago," or "Italian restaurants my friends have visited nearby."
However, it's a bit of a double-edged sword as well. Andrew Storms, director of security operations for nCircle, says, "The new Facebook Graph Search is a phishers' dream come true. It takes the micro-targeting capabilities that have been available to online advertisers for years and puts them into the hands of cyber criminals."
Think of it like Google hacking on steroids. Attackers learned long ago that Google is a virtually endless treasure trove of valuable information--sensitive data, and seemingly innocuous tidbits that can be used to hack into a network or account. Facebook Graph Search raises the bar--and not in a good way--by delivering that same capability with a more personal context.
Alex Horan, security strategist for CORE Security points out the inherent conflict of interest of a tool like this because Graph Search is only useful if it provides relevant and interesting results. "This means Facebook will want it to have as much information available as possible to respond to each query, ensuring people have a positive experience. This directly goes against the desire expressed by people to keep their information private."
Using Facebook Graph Search, an attacker can narrow down specific targets, and customize emails or Facebook messages using compelling details about their lives, their friends, the things that interest them, and the places they've visited.
Richard Wang, manager at Sophos Labs, says Graph Search might be a startling eye-opener for many. This will probably lead more users to discovering that they have shared more than they expected and gives scammers the opportunity to target particular groups of people."