Introduction to Social Networking• Massive adoption in the consumer market

– MySpace, Facebook, LinkedIn, Friendster – SecondLife– Ning , etc.

• Statistics on Facebook – Over 64,000,000 users – Over 250,000 new registrations per day– Over 200,000 developers have submitted some sort of Facebook application using

basic programming skills and there are over 15,000 official apps– Users can add up to 20 friends per day– Facebook apps can be considered as XHTML snippets that inherit all the properties of

web applications

Ideal Exploitation Platform?• Social networks have intrinsic properties that make them ideal to be

exploited by an adversary:

– Difficult to police: very large and distributed user base– Trust network: clusters of users sharing the same social interests developing trust with

each other– Platform openness for developing applications that are attractive the general users

who will install them

Other Precedents?• One of the ways to think about the broader risks of social networking

against critical infrastructure is related to the problems of state-sponsored attackers

– “People’s War” concept a la Dragon Bytes – many home computers used as soldiers– Similar problem seen with Gnutella used as a DDOS platform– A rogue social network app could be used in the same manner or worse

Two Social Networking Sites91 Percent of Phishing Attacks

• In an analysis of cyber crime activity in the 2nd half of 2007, security vendor Symantec Corp. found that two social networking sites together were the target of 91 percent of U.S.-based phishing Web sites. Social networking sites also were the leading targets of phishing sites located in four other countries listed by Symantec in its phishing Top 10.

Source: Symantec Corp.• Hijacked social networking pages often are used to host malicious

software or "malware" directly or to host links phishing or malware sites that are then advertised in messages sent to all of the contacts in the victim's social network.

Top Targeted Phishing Sites

Why Don’t We Just Ban It All• Banning public social networking sites from corporate use may help with

the distraction factor and with some of the other technical issues, but..

– In many cases, there is just too much personal information posted on these sites– Information such as the full names of parents, pets, schools and other “keys” that are

used to unlock personal and professional accounts– Embarrassing or inappropriate pictures that could be used in blackmail scenarios (think

Cold War)– Lifestyle information that may create personal or professional problems

Taking It to the Extreme

• If an adversary were able to develop an application as successful as FunWall, for example, a victim host would have to cope with about 23 Mbit/sec of unsolicited traffic and nearly 248GB a day of unwanted data

• Of course, this assumes a lot about bandwidth and the lack of proper network and security management…

• But, adversaries don’t need all that bandwidth.

• Here's a look at the seven most lethal social networks hacks: – 1) Impersonation and targeted personal attacks – 2) Spam and bot infections – 3) Weaponized OpenSocial and other social networking applications – 4) Crossover of personal to professional online presence – 5) XSS, CSRF attacks – 6) Identity theft – 7) Corporate espionage

Social Networking

Social NetworkingBecause of its huge base -- last month Facebook said it had more than 300 million users -- the site is a frequent target for hackers and identity thieves

• 10-28-2009– Researchers at several security firms have uncovered a spam campaign targeting

Facebook users. The e-mails, which pose as communications from Facebook about password resets, contain a nasty downloader that ultimately makes users part of a notorious botnet.

• 10-02-2009– Facebook Attackers May Have Cracked CAPTCHAResearchers at AVG Technologies may

have uncovered a scheme by attackers to circumvent the CAPTCHA protections on Facebook to create fraudulent accounts.

• 02-09-2009– Rik Ferguson, senior security advisor for Trend Micro, said the social networking Web

site based in Palo Alto, Calif., has been hit in the past week with four malicious applications and a new version of the Koobface virus that was first detected in December 2008, the BBC reported Monday

• Avoiding Social Engineering and Phishing AttacksHow do you avoid being a victim?– Be suspicious of unsolicited phone calls, visits, or email messages from individuals asking

about employees or other internal information. If an unknown individual claims to be from a legitimate organization, try to verify his or her identity directly with the company.

– Do not provide personal information or information about your organization, including its structure or networks, unless you are certain of a person's authority to have the information.

– Do not reveal personal or financial information in email, and do not respond to email solicitations for this information. This includes following links sent in email.

– Don't send sensitive information over the Internet before checking a website's security (see Protecting Your Privacy for more information).

– Pay attention to the URL of a website. Malicious websites may look identical to a legitimate site, but the URL may use a variation in spelling or a different domain (e.g., .com vs. .net).

Social Networking

– If you are unsure whether an email request is legitimate, try to verify it by contacting the company directly. Do not use contact information provided on a website connected to the request; instead, check previous statements for contact information. Information about known phishing attacks is also available online from groups such as the Anti-Phishing Working Group (http://www.antiphishing.org).

– Install and maintain anti-virus software, firewalls, and email filters to reduce some of this traffic (see Understanding Firewalls, Understanding Anti-Virus Software, and Reducing Spam for more information).

– Take advantage of any anti-phishing features offered by your email client and web browser.

Social Networking

• http://www.staysafeonline.org/blog/staying-safe-social-media-web-sites• http://www.thetechherald.com/article.php/200938/4434• http://www.us-cert.gov/cas/tips/ST04-014.html• http://www.justaskgemalto.com/us/focus/managing-your-digital-identity-

social-media-sites• http://edition.cnn.com/2009/TECH/07/16/twitter.hack/

Social Networking