Social Networking's Security Pitfalls

Spending a little time on Facebook and other social networking sites is a ritual for many of us every morning. And afternoon. And evening. But, hey, it's nice, harmless fun-isn't it? It isn't as if you were putting your identity or your computer at risk. Are you? Well, ask anyone who was whacked by the recent Koobface worm.

Slideshow: 12 tips for safe social networking
Slideshow: Where IT pros do their social networking

According to the folks at anti-malware vendor Kaspersky Lab, the social networking world is a veritable minefield of places where a misstep can mean dire consequences for the unfortunate user.

The aforementioned Koobface, for example, invited recipients to click on a link in their Facebook in-box, apparently from someone they know, which supposedly plays a funny video (a real hazard at some times of year-how much eggnog did you have at that holiday bash?). Those who fell for that part of the scam were then told that they needed an update to their Flash player to view the video, and were provided with an executable of said update. With me so far?

This alleged Flash update actually downloads a proxy server, which it loads when the computer is restarted. This lets it redirect traffic to sites of its choosing; it may, for example, hijack a search request and send it to a different engine where hits make money for the perpetrator. It also adds a sneaky little program that can be instructed to download other malware at some point. Like magic, your computer is now a zombie, under the control of unknown villains. Of such are botnets created.

To add to the fun, there's a version of Koobface for MySpace as well, and the Facebook and MySpace versions cross-pollinate. Are you hearing the X-Files theme music yet? Trust no-one!

Kaspersky's senior malware analyst Sergey Golovanov says that discussions he follows on hacker forums (yes, the good guys do spy on the bad guys-how else can they catch wind of evil in time to head it off) talk about vulnerabilities in the software running social networking sites that makes them hackable. For example, he says, it would be a good idea to implement SSL (secure) connections in MySpace for the transmission of passwords; right now, passwords are transmitted in plain text, which makes them easy to intercept and steal. This vulnerability was discussed at the Black Hat hacker conference three years ago, and anti-malware organizations have been in touch with MySpace, but nothing has been done as yet.

However, he says, the issue isn't just technology. It's about using trusted connections against people. An account, once hacked, can be used to send spam or conduct fraudulent activities, persuading others to become infected with malware because they trust the friend from whom a message came.

There's even a booming market in "friends" and connections-those with misdeeds in mind can come to certain hacker forums and say they want to meet a particular person, and it will be done, for a price.

In fact, says Golovanov, in 2008 Kaspersky received well over 20,000 malware samples that attack social networks in some way-that's close to 100 per day!