Another Day, Another Facebook Hack

"For all the credit Facebook has received for its privacy controls and user safety, the site still falls prey to an unsettling number of security issues and potential data breaches. Last month a botched code push accidentally revealed private user email addresses, and before that Facebook accidentally sent private messages to the wrong recipients. Today, security engineer Joey Tyson, AKA theharmonyguy, has detailed a major security hole in Facebook Platform — one that would allow a malicious website to silently access a user’s profile information, photos, and in some cases, messages and wall posts, with no action required on the user’s part..."

From TechCrunch...

Trust No One 2.0

"Facebook founder Mark Zuckerberg has been accused of hacking into the email accounts of rivals and journalists.

"The CEO of the world's most successful social networking website was accused of at least two breaches of privacy in a series of articles run by BusinessInsider.com.
As part of a two-year investigation detailing the founding of Facebook, the magazine uncovered what it claimed was evidence of the hackings in 2004.

"In the first instance, it said that, when Zuckerberg discovered that Harvard's student newspaper The Crimson was planning on running an article on him in 2004, he used reporters' Facebook logins to hack into their accounts.

"In the second instance, the magazine claimed Zuckerberg hacked into the accounts of rivals at Harvard who accused him of stealing their idea for a social network. He then allegedly tried to sabotage the rival network they had set up..."

Read thw whole story here...

Google's Downfall: Social Networking

"People behind the China-based online attacks of Google and other companies looked up key employees on social networks and contacted them pretending to be their friends to get the workers to click on links leading to malware, according to a published report on Monday.

"`The most significant discovery is that the attackers had selected employees at the companies with access to proprietary data, then learnt who their friends were,` the Financial Times reported. `The hackers compromised the social network accounts of those friends, hoping to enhance the probability that their final targets would click on the links they sent.`

"`We're seeing a lot more up-front reconnaissance, understanding who the players are at the company and how to reach them,` George Kurtz, chief technology officer at security firm McAfee, told the Financial Times. `Someone went to the trouble to backtrack: 'Let me look at their friends, who I can target as a secondary person.'`"

"The attackers used a popular instant-messaging program to distribute the malware link to target employees, Kurtz said. The malware exploited a hole in Internet Explorer that Microsoft patched just last week."

More at CNET...

Facebook Follies

"Vanessa Palm and Alexander Rust, two 20-something Americans vacationing in the Bahamas last February, decided to catch and eat an iguana - a species protected under Bahamian law. Unfortunately for them, they also decided to post pictures on Facebook of their illicit meal.

"Bahamian authorities were alerted to the photos, and promptly proceeded to track down and arrest the two tourists for killing and eating a protected iguana.

"Perhaps they used the jail time to debate whether or not it tasted like chicken.

"Similarly, a 20-year-old employee of a Petland pet store in Ohio not only drowned rabbits from the store, she creepily bragged about it on her Facebook "wall." Someone from People for the Ethical Treatment of Animals (PETA) learned of this, and she was soon charged with two counts of animal cruelty.

"Meanwhile, it wasn't enough for 38-year-old Jacob Rehm of Morrisville, Vt., to steal a tour bus from his former employer, Lamoille Valley Transportation, and take it on a joyride. No, he had to go and make a four minute video of his little adventure (complete with a tour of the $500,000 bus itself) and post it on YouTube.

"After the bus was recovered in another town and Rehm was charged with the theft, the prosecutors found that video very helpful when they went to court."

More at The Southeast Texas Record...

McAfee To Leverage "Captive Audience" Marketing

"Facebook announced late Tuesday that it is offering free computer security software for six months to all of its 350 million members to head off increasing threats of hackers and computer viruses on the social network.

"Facebook has cut a deal with anti-virus maker McAfee Inc. of Santa Clara to provide the security software, available on McAffe's Facebook fan page.

"McAfee's Internet Security Software Suite will be free for six months and available for a "special discount subscription" afterwards, the companies said in a statement. The announcement did not detail how much the paid subscription would cost once the free period ends..."

More at SFGate...

Facebook Users PWN3D By Rubber Ducky, Cats

"In research commissioned by The Daily Telegraph, which has shocked even top fraud squad police, almost half of users in their 20s agreed to a request from a rubber duck to be Facebook `friends`.

"A similar result occurred with a group of internet users in their 50s, with many agreeing to be Facebook friends with a photo of two cats.

"Many of the Facebook users in both age groups volunteered some of their most intimate details to both the rubber duck and the cats, including their full date of birth, workplace, email address and location. Some even volunteered full addresses and phone numbers without prompting.

"The study was conducted by leading internet security firm Sophos.

"It has raised serious questions about the wisdom of average internet users, given the friend requests were sent without any introduction."

More at The Daily Telegraph...

Push "da button", Frank

"Some Facebook users have been infected with a worm after clicking on an image of a scantily clad woman, which then redirects the victims to a pornography site, according to security researchers.

"The worm posts an image on a victim's Facebook Wall with a photo of a woman in a bikini and the message `click 'da button, baby.` Wall posts are viewable by a Facebook user's friends.

"If a friend clicks on the image and is logged into Facebook, the image is then is posted to their own Wall. Their Web browser will then open a Web page with a larger version of the same image. A further click on "da button" redirects the friend to a pornography site, according to Roger Thompson chief research officer for antivirus vendor AVG Technologies. Thompson posted a video of the attack on his blog."

From ComputerWorld...

Savvy Workers Resist Facebook Fad

"When CIO Will Weider encouraged employees at Ministry Health Care and Affinity Health System in Wisconsin to use Facebook to spread the word about new programs and successful projects, he was surprised at the result: Few did so.

"`I went in there thinking, 'We've turned these people loose; we'll have 10,000 marketers out there,'` Weider says. But the Ministry Health workforce, it turned out, had been well trained to protect sensitive data, and without explicit guidance on what they could say, their first reaction was to share nothing.

"`We've stressed the importance of data security with our employees, particularly when it comes to patient privacy, and it's kept them from sharing all the great things about work on Facebook,` Weider says.

"That's a good problem to have. Many fear that the popularity of social networking -- among individuals as well as organizations -- will precipitate an increase in social engineering attacks that could result in security breaches that expose corporate data or damage a company's reputation."

More at NetworldWorld...

Young workers' use of social networking sites concerns IT staffs

"Social-networking sites such as Facebook and MySpace are being targeted so often by cybercrooks and other mischief-makers that half of the information-technology specialists surveyed recently by Intel expressed concern about workers under 30, who disproportionately use such sites.

"Of the 200 corporate and government IT professionals in the United States and Canada who were surveyed, 13 percent said they regard so-called Generation Y employees as "a major security concern," and 37 percent tagged them as "somewhat of a security concern." The biggest worry they mentioned was the tendency of many Gen Yers to frequent social-networking sites like Facebook and MySpace."

More at MercuryNews...

Koobface computer virus attacks Facebook users

Facebook's millions of users are in the crosshairs of a computer virus dubbed Koobface that is being spread through the social networking site's messaging system.

Users whose computers are infected may have their credit card numbers stolen or their searches on Google, Yahoo and MSN diverted to fraudulent Web sites.

More...

[Hinky NOTE: see also my commentary at the UT Blog -HD]