Businesses dipping into the world of social media are increasingly vulnerable to virus infections, security experts told ITBusiness.ca.
“When you think about it there’s absolutely no reason for cyber criminals not to hit a site like Facebook. It’s the perfect target,” said Claudiu Popa, security specialist and president of Informatica Security Corp., an information risk management, security and privacy consulting firm in Toronto.
He said firms with a social media presence need to shore up their defenses against malware, such as the virus-laden spam e-mails targeting Facebook’s estimated 400 million users.
Related stories
Free anti-spam and malware tool for Facebook
Five formidable Facebook frauds and how to protect yourself
Facebook — get your security act together, says frustrated expert
The site, Popa said, has the ideal combination of viral technology and users who aren’t too focused on privacy and security issues.
The point is echoed by an executive from anti-virus and encryption software firm MacAfee Inc.
Users of social networks will have to live with the fact that these sites are spam and malware magnets, said Dave Marcus, McAfee’s director of malware research and communications.
“With Facebook as your lure, you potentially have 400 million people who can click on a spam attachment. Even if you get a 10 per cent success rate, that’s 40 million infected.”
Facebook virus floods Internet
Last Friday, McAfee detected a virus-laden spam message that was flooding the Internet.
The e-mail told recipients their Facebook account passwords had been reset by the company, and instructed them to click on an attachment to obtain new login credentials.
“Once a user clicks on the attachment, it downloads several types of malware, including one that steals passwords,” said Marcus.
The spam email causing trouble for Facebook users
McAfee has not determined how many users were affected but Marcus said victims could easily number in the millions.
Facebook has been regular target of spammers, who use the company’s own e-mail system to spread malware. Marcus said attackers have started to use regular Internet e-mail to spread their malicious software.
Facebook meanwhile notified users that the circulating e-mail is not from the company and warned them against opening the attachment.
Last week, Facebook issued this caution to users on its security page:
There’s another spoofed e-mail going around that claims to be from Facebook and asks you to open an attachment to receive a new password. This e-mail is fake. Delete it from your inbox, and warn your friends. Remember Facebook will never send you a new password in an attachment …
Facebook also advised users check out the sites Threats and Tips tabs for information on how to stay safe on Facebook and the Internet.
The fallout for business
Spam and phishing attacks, such as these, are a menace for organizations doing business on social networks.
For instance, a business with a Facebook presence could have a customer whose account has been compromised. Attackers can use that account to infect the victim’s Facebook friends and the company’s other clients as well, said Popa of Informatica.
“Apart from flooding users with spam messages that could tie down an IT department, there’s huge potential for widespread identity theft,” he said.
Affected businesses — and even Facebook — will suffer from negative publicity, said Marcus of McAfee.
“For example, this spam e-mail wasn’t sent by Facebook, but it won’t help their brand either when Facebook members suffer,” Marcus said.
How to protect yourself
If you opened the virus tainted email or think your computer has been hacked, you can go to Facebook help centre at: http://www.facebook.com/help/?page=1014
Areas flooded by spoofed Facebook email
Claudiu of Informatica said the best defense for this type of attack is “common sense” and practical security procedures. “It’s the same advice every time. Never open an e-mail that’s suspicious. Don’t click on an attachment that’s questionable.”
Marcus of McAfee said companies, such as Facebook, would not send a password reset via an e-mail containing a link or attachment. “If you have to access your account or change passwords don’t do it through an attachment or link. Use the company’s site instead.”