Do you rely on social networks to boost your professional or personal profile? Does your company launch marketing campaigns on sites such as Facebook, Twitter, YouTube or BlogSpot?
If so, you certainly need to beef up security, as a huge chunk of the traffic generated on these sites comes from scamsters rather than bonafide users.
At times malware or spam is so intertwined with genuine traffic, it’s difficult to distinguish one from the other.
Social networks have become the target of all sorts of cyber crooks, say experts from two online security software firms.
Nearly 95 per cent of user comments in blogs, chat rooms, message boards and other social forums are actually spam or links to malware, according to a recent report from Websense Inc., a Web security software developer in San Diego, Calif.
What’s more, security tools provided by sites such as YouTube and BlogSpot are only 25 to 35 per cent effective in protecting Web users from “objectionable content and security risks,” noted Carl Mercier, director of software development at Websense.
Related Story
Seven social network security mistakes you can”t afford to make
The decade of convergence and the (n)ever-changing risk landscape
A separate study by RSA Security, the security division of EMC Corp, found at least 20 per cent of all online attacks, last year, targeted social networking sites.
Social nets are low hanging fruits for cybercrooks of every variety, said Seth Geftic, senior manager with RSA’s identity protection and verification group. That’s because of the viral nature of social network communications and users’ unquestioning trust of their network “friends.”
Lethal links
Last year, Facebook users exceeded 300 million, while there were an estimated 12.1 million Twitter users.
Social networking and blogging are now the fourth most popular online activity, with communities being visited by around 67 per cent of the global online population, according to Nielsen Online.
This surge in traffic has prompted many online attackers to change their strategies, says Mercier of Websense.
“Over the past year-and-a-half, we noticed a big shift from typical Viagra sales-type spam to malware- infected links directed ats social net users.”
Rather than send spam e-mail messages, he said, spammers today are more likely to broadcast comments on to various blog sites and social net pages.
“These comments are likely to contain infected links that inject Trojan malware in a blogger’s machine or lead them to an infected site.”
At least 37 per cent of Web attacks included data-stealing code, indicating that attackers are after essential user information and data, according to Websense Security Lab.
The Websense report also revealed that the “dirty Web” is getting dirtier. Around 69 per cent of Web sites with objectionable content (porn, adult content, gambling) also had a link to malware or malicious sites.
“In the past six months fraudsters have heightened attacks on popular Web 2.0 sites and continue to compromise and trusted sites,” said Dan Hubbard, chief technology officer atfor Websense.
“Give us more security”
Users of social networks and other commercial or government online services are well aware of the security risks and are demanding greater Web security, according to the survey carried out by RSA.
The views of 4,500 adults from 22 countries on online services and threats were sought by the RSA 2010 Global Online Consumer Security Survey.
The vast majority of Canadians polled indicated they regularly visit and actively use online baking, social networking, and government healthcare sites.
Ninety-seven per cent of Canadians polled were aware of online threats, such as phishing. About 22 per cent said they had been victims of phishing attacks.
Canadians said they were concerned with their personal information being accessed or stolen at their banking sites (76 per cent); at social networking sites (71 per cent); at healthcare portals (53 per cent); and at government portals (64 per cent).
Respondents called for stronger security features that would help them identify users when they log on to online banking sites (64 per cent); healthcare portals (60 per cent); government sites (65 per cent); and social networking sites (52 per cent).
RSA’s Geftic said the lower demand for security in social networks may be traced to three factors.
– Users are more familiar with reports about e-commerce sites being breached
– The perception that information on social networks is not that important to thieves; and,
– The greater element of trust in social nets because users are communicating with friends, or think they are
These perceptions, Geftic said, are deceptive and dangerous for those individuals and organizations using social networks.
Social sites – such as Facebook, Twitter, MySpace or blog sites are replete with scattered personal information, which hackers can use to steal identities, he said.
Culling data, such as middle names, schools, addresses, parents’ and friends’ names from various sites, an attacker can patch together enough information to hack into a person’s bank or credit card account, Geftic said.
“These pieces of information are highly valuable to an ID thief because a single credit card is worth only $1 in the cyber blackmarket, but one with a full identity profile — such as a social security number, user’s birth date or mother’s maiden name — is worth $20.”
Your trusted friend may also be unwittingly passing along infected links, Geftic warns.
“Attackers count on the viral nature of social net conversations. They can hack into your friend”s list and send malware to our account.
Celebrity Twitter account hacking, might be used for pranks, but this practice could also be easily turned to deliver malware or launch attacks on businesses, he said.
For frms running a social networking site, the risks centres on brand reputation and possible legal liability.
Companies have to deal with the stigma of having an infected site but might also have to face legal suits filed by clients whose accounts or personal data were compromised.
Many government municipalities and agencies, setting up their own social net presence face the same risks.
Free Security tools
Websense on Thursday released a beta version 2.0 of its Defensio social Web threat detection product. Defensio 2.0, available for free download for a limited time, analyzes and classifies user generated content posted on Web 2.0 as blog sites and Facebook, said Mercier.
“This first real-time security application for Facebook pages is It’s ideal for individuals and businesses with a Facebook presence,” he said.
The application alerts the Facebook page owner if malicious or inappropriate content has been posted to their site. Filter can be set by the user. Once a risk is identified, the user can safely delete the content to prevent it from spreading to Facebook friends and fans.
