Spending a little time on Facebook and other social
networking sites is a ritual for many of us every morning. And afternoon. And evening. But, hey, it’s nice, harmless
fun—isn’t it? It isn’t as if you were putting your identity or your computer at risk. Are you? Well, ask anyone who was
whacked by the recent Koobface worm.
According to the folks at anti-malware vendor Kaspersky Lab, the social networking world
is a veritable minefield of places where a misstep can mean dire consequences for the unfortunate user.
The aforementioned Koobface, for example, invited recipients to click on a link in their Facebook in-box, apparently from
someone they know, which supposedly plays a funny video (a real hazard at some times of year—how much eggnog
did you have at that holiday bash?). Those who fell for that part of the scam were then told that they needed an update to
their Flash player to view the video, and were provided with an executable of said update. With me so far?
This alleged Flash update actually downloads a proxy server, which it loads when the computer is restarted. This lets it
redirect traffic to sites of its choosing; it may, for example, hijack a search request and send it to a different engine
where hits make money for the perpetrator. It also adds a sneaky little program that can be instructed to download other
malware at some point. Like magic, your computer is now a zombie, under the control of unknown villains. Of such are botnets
To add to the fun, there’s a version of Koobface for MySpace as well, and the Facebook and MySpace versions
cross-pollinate. Are you hearing the X-Files theme music yet? Trust no-one!
Kaspersky’s senior malware analyst Sergey Golovanov says that discussions he follows on hacker forums (yes, the good guys
do spy on the bad guys—how else can they catch wind of evil in time to head it off) talk about vulnerabilities in the
software running social networking sites that makes them hackable. For example, he says, it would be a good idea to implement
SSL (secure) connections in MySpace for the transmission of passwords; right now, passwords are transmitted in plain text,
which makes them easy to intercept and steal. This vulnerability was discussed at the Black Hat hacker conference three years
ago, and anti-malware organizations have been in touch with MySpace, but nothing has been done as yet.
However, he says, the issue isn’t just technology. It’s about using trusted connections against people. An account, once hacked, can be used to send
spam or conduct fraudulent activities, persuading others to become infected with malware because they trust the friend from
whom a message came.
There’s even a booming market in “friends” and connections—those with misdeeds in mind can come to certain hacker
forums and say they want to meet a particular person, and it will be done, for a price.
In fact, says Golovanov, in 2008 Kaspersky received well over 20,000 malware samples that attack social networks in some
way—that’s close to 100 per day!
One particularly nasty item he’s spotted hacks an account and starts making posts in forums in the victim’s name. The
victim, however, can’t see these posts, so could get kicked out—or worse—without ever knowing why.
The business of perpetrating these attacks is huge. According to Golovanov, there are specialized teams built out to
attack and process information from social networks, including coders who write the malware, those who run the servers, those
who sell the data collected, and those who actually perform the attacks and gather the data. One group, he says, is doing so
well that it employs not one, not two, but three accountants to manage its ill-gotten gains!
Believe it or not, despite all this Golovanov says that these organizations have not yet reached the sophistication of
botnets. That will likely happen in 2009. As it is, Kaspersky has seen a doubling in social networking attacks over the past
six months, even though malware as a whole has plateaued.
But think about this: Malware targeting online games has skyrocketed—on a bad day, Kaspersky receives 5,000 Trojans
to examine (a good day is a “mere” 3,000)—and that, says Golovanov, is where social networking attacks could be
Now, about that eggnog—want to see a funny video?