Social Networking’s Security Pitfalls: How You Can Go Oh So Wrong with Facebook, LinkedIn and MySpace

Spending a little time on Facebook and other social networking sites is a ritual for many of us every morning. And afternoon. And evening. But, hey, it’s nice, harmless fun—isn’t it? It isn’t as if you were putting your identity or your computer at risk. Are you? Well, ask anyone who was whacked by the recent Koobface worm.

According to the folks at anti-malware vendor Kaspersky Lab, the social networking world is a veritable minefield of places where a misstep can mean dire consequences for the unfortunate user.

The aforementioned Koobface, for example, invited recipients to click on a link in their Facebook in-box, apparently from someone they know, which supposedly plays a funny video (a real hazard at some times of year—how much eggnog did you have at that holiday bash?). Those who fell for that part of the scam were then told that they needed an update to their Flash player to view the video, and were provided with an executable of said update. With me so far?

This alleged Flash update actually downloads a proxy server, which it loads when the computer is restarted. This lets it redirect traffic to sites of its choosing; it may, for example, hijack a search request and send it to a different engine where hits make money for the perpetrator. It also adds a sneaky little program that can be instructed to download other malware at some point. Like magic, your computer is now a zombie, under the control of unknown villains. Of such are botnets created.

To add to the fun, there’s a version of Koobface for MySpace as well, and the Facebook and MySpace versions cross-pollinate. Are you hearing the X-Files theme music yet? Trust no-one!

Kaspersky’s senior malware analyst Sergey Golovanov says that discussions he follows on hacker forums (yes, the good guys do spy on the bad guys—how else can they catch wind of evil in time to head it off) talk about vulnerabilities in the software running social networking sites that makes them hackable. For example, he says, it would be a good idea to implement SSL (secure) connections in MySpace for the transmission of passwords; right now, passwords are transmitted in plain text, which makes them easy to intercept and steal. This vulnerability was discussed at the Black Hat hacker conference three years ago, and anti-malware organizations have been in touch with MySpace, but nothing has been done as yet.

However, he says, the issue isn’t just technology. It’s about using trusted connections against people. An account, once hacked, can be used to send spam or conduct fraudulent activities, persuading others to become infected with malware because they trust the friend from whom a message came.

There’s even a booming market in “friends” and connections—those with misdeeds in mind can come to certain hacker forums and say they want to meet a particular person, and it will be done, for a price.

In fact, says Golovanov, in 2008 Kaspersky received well over 20,000 malware samples that attack social networks in some way—that’s close to 100 per day!

One particularly nasty item he’s spotted hacks an account and starts making posts in forums in the victim’s name. The victim, however, can’t see these posts, so could get kicked out—or worse—without ever knowing why.

The business of perpetrating these attacks is huge. According to Golovanov, there are specialized teams built out to attack and process information from social networks, including coders who write the malware, those who run the servers, those who sell the data collected, and those who actually perform the attacks and gather the data. One group, he says, is doing so well that it employs not one, not two, but three accountants to manage its ill-gotten gains!

Believe it or not, despite all this Golovanov says that these organizations have not yet reached the sophistication of botnets. That will likely happen in 2009. As it is, Kaspersky has seen a doubling in social networking attacks over the past six months, even though malware as a whole has plateaued.

But think about this: Malware targeting online games has skyrocketed—on a bad day, Kaspersky receives 5,000 Trojans to examine (a good day is a “mere” 3,000)—and that, says Golovanov, is where social networking attacks could be heading.

Now, about that eggnog—want to see a funny video?