Social Networking Sites - Be Careful

Have you signed up on a social networking site? If you have, you've joined literally millions of others who are on FaceBook, MySpace, LinkedIn, and Twitter just to name a few. If you've signed up for any of these networks, you have probably wondered if there are security risks involved in participating in them. There risks associated with them and they are all related in one way or another.

First, the one common thread in all social networking sites is that you can associate (network) with friends and family, or work associates and share information with them. There is an inherent trust built in that if I allow you to be in my network, I trust you that it is really you and if you post anything, I'm assuming that it is you. Criminal hackers take advantage of this trust that is built in and if they can steal your login credentials to your account, they can pose as you and send all the friends in your network a message with a link that leads to a malicious web site. If successful, your friend's PC will have malicious code installed on their PC and this allows the criminal hacker to continue to take advantage of others as this process is repeated over and over with each friend who clicks on the malicious link.

Another risk of these social networking sites is what you actually post on these sites. One of the things you can do is share pictures with family and friends. You need to think twice before publishing certain pictures. One rule of thumb you should remember before you post anything on any web site is not to post anything that you don't want everyone to see. Even if you have posted a picture as "private", there have been instances in the past where the actual site you post pictures to has vulnerability in their systems which allowed "private" pictures to be stolen.

When you sign up for these sites, you can fill out a profile of personal information that you should limit what is available. For instance, you can add your birthday and you may choose to only put the month and day and drop the year of your birthday. Your birth date is one personally identifiable piece of information used in many things and you may want to exclude sharing the year of your birth. It is also a good idea not to post your phone number or your full address.

This one is specific to Twitter. First, what is Twitter? Twitter is a micro blogging system that allows you to share your status with anyone who follows you. These are called "tweets". These tweets are limited to 140 characters. Some folks who use Twitter like to share links to web sites that give you more information on a topic. Since links to web sites can be long, they use services that take a long web address, and shorten it. There are services like Tiny URL that do this. Criminal attackers have hacked high profile accounts that include CNN, the Obama campaign, and celebrities such as Brittney Spears. With control of these accounts, they can then abuse the trust issue mentioned earlier in this article and send out malicious links.

What can you do to protect yourself? Here are a few things.

• Keep your home PC patched which includes Microsoft updates as well as Adobe, QuickTime, and iTunes, just to mention a few.

• Think twice before posting any picture. A good rule of thumb is not to post anything that you wouldn't want everyone to see.
  

• Limit what information you share in the profile section of social networking sites.
  

• Trust no one. If a friend sends you a link, treat it like you have been trained with phishing e-mails. Don't click on unsolicited links.

Twitter Credentials Being Stolen

So recently, some Twitter users were offered a link to Twittercut to gain more followers. It appeared to be coming from a known contact, and they promised you to accumulate more and more followers.

It seems that TwitterCut appeared to be the real Twitter login page. A phishing site for sure.

If a person were tricked into entering their login credentials, Twittercut continued to send the same message you got to all of your contacts. At this point, it appears that no malware is being installed on victim's PCs.

For sure, Twittercut has the login credentials to many Twitter accounts. Twittercut has been listed on services that blacklist malicious sites but was still active just a couple of days ago.

This attack takes advantage of the trust that is built on networks like Twitter, as well as FaceBook, MySpace, LinkedIn, and other social networks. Always beware of messages that are unsolicited. My motto is "trust no one".

Stay safe and have a fabulous rest of the weekend.

Friend's E-mail Account Hacked

The other day, I received an e-mail from a friend with a subject line of "Look". The body of the e-mail was short and sweet. It said "* Hi! Click the link, there is something funny for you" followed by a link that looked innocent enough to me. The computer security person in me thought this was a bit strange so I did a little checking on the site that was referenced in my friends e-mail.

After some checking, I found that the site was considered malicious and was hosted in China. I responded back to my friend and said that the computer security person in me wondered if he really had sent this. No response. Another few days and I get another e-mail from him with the same link. At this point, I contact him and he says no he didn't send me or any of the other contacts he had in his address book that were included on this e-mail.

Lesson, my friend had his e-mail account hijacked. The attacker who had control was trying to take advantage of the trust between my friend and his contacts in his address book. I sent a response to all the others who received the e-mail warning them of the malicious link. I never heard back from anyone but I had done my part.

Be careful when you receive an e-mail from a friend with a link, and this is also true of the other social networks like FaceBook, MySpace, and LinkedIn. My motto in computer security is to trust no one. Don't just randomly click on links just because one of your friends sends you a link. Hijacked accounts will send out messagse with malicious links and take advantage of the trust that is built up on these types of networks.

Be careful out there and stay safe. Happy Tuesday!

567,000 Private Photos From MySpace Hacked

Now I tell you this, I am no expert on MySpace. I don’t have a MySpace page. I don’t plan on getting a MySpace page. But you may have a MySpace page or your kids may have a MySpace page. And if you do, this story may have caught your attention. Not too long ago, 567,000 photos that were marked private on MySpace were accessed, copied, and now are available on a 17 gig torrent.

One of the things MySpace does to protect minors against pedophiles is to mark photos posted on their MySpace page private so only “friends” they have can access these photos. Adults who have MySpace pages also can mark photos either public or private. If they are marked private, it works the same way. Only people they have designated certain “friends” are able to access these private photos. Due to a vulnerability in the MySpace private photos, some 567,000 were extracted from the MySpace files. Now one might wonder how could MySpace not see hundreds of thousands of requests from one IP address isn’t seen. A 17 gig file is huge not to see.

Oh well. Supposedly this has been fixed. But the lesson should be this. If you ever post pictures that are supposedly private on the Internet, someday, someway, their may be a possible software vulnerability that allows someone to steal these pictures and they will live forever as a file that can be accessed. This is something I try and suggest. Never post anything that you wouldn’t mind being seen by everyone. I haven’t read any details, but I’m sure there are some nude pictures that have been posted and were assumed protected by being marked private. Well not so.

This is a good example of creating your own “need to know policy” where you don’t disclose anything about yourself online. Crooks are always looking for ways to steal information about you. If you have kids and they are on MySpace, you may want to warn them that if they had pictures marked private, there are thousands and thousands now that are public record. Some may be embarrassing, so warn them of the dangers of posting things on the Internet and don’t let people know too much about you. Protect your privacy by not disclosing anything without thoughtful consideration.

Take care and stay safe.