August 8th, 2008
Facebook's (futile) malware exorcism - can social networks fight back?
In the wake of two recent worm attacks on Facebook, the popular social networking site responded last night with a statement about its security practices. Regarding the attacks, Max Kelly, head of security at Facebook, wrote this in a blog post:
…we spent most of last night working on a fix for a worm, which was targeting people on Facebook and placing messages on Walls urging users to view a video that pretends to be hosted on a Google or YouTube website. We’ve identified and blocked the ability to link to the malicious websites from anywhere on Facebook.
Have they now? Kelly writes that he and his team are soon headed to Defcon 16 this weekend in Las Vegas to learn how to make the site safer. Perhaps he and his team plan to attend “Satan Is On My Friends List” about securing social networks. But, really, is there a solution for Facebook waiting at Defcon? Probably not, and here’s why:
- Making a social network secure is darn near impossible. As fast as Facebook (or any other social network) blocks those known malicious site hackers will come up with new ones. There’s no “patch” or “fix” for these issues.
- Why? The major flaw with social networks comes down to user awareness and user responsibility. Kelly correctly states that many people use the Internet without any knowledge of security threats posed by hackers. Which makes these users…
- …primary targets for online social engineering scams, similar to what was presented with the “Court Jester” malware attack. If users are unaware as to the threats presented by clicking on outside links, they are easily going to be spoofed. Facebook cannot keep its users from clicking off the site and downloading files.
“If a site allows any kind of links at all, then what a user does after they follow that link is really out of control of the social networking site,” said Wesley McGrew, who operates McGrew Security. “They can keep blocking the links to malicious sites as they pop up and they can try to educate their user base but that’s about it. Facebook is likely at the mercy of the security of each user’s home computer.”
If a user’s home PC gets owned, the malware can navigate the social network much in the same way that a legitimate user can. That could be tough for the Facebook security team to detect as the malware would have similar attributes to the user. While attacks on Facebook applications are not new the hackers’ ability to penetrate the Facebook wall is a big deal — and it’s these types of attacks that had a terribly negative effect on MySpace’s perceived viability when its pages began to get compromised on a regular basis.
Next: What should social networks do? –>
Pages: 1 2
Jennifer Leggio, aka "Mediaphyter," writes about the "social business" side of social media - including enterprise, security and reputation issues. See her full profile and disclosure of her industry affiliations.
For daily updates on Jennifer's activities, follow her on Twitter.
Subscribe to Social Business via Email alerts or RSS.
