Introduction to Social NetworkingMassive adoption in the consumer marketMySpace, Facebook, LinkedIn, Friendster SecondLifeNing , etc.Statistics on FacebookOver 64,000,000 users Over 250,000 new registrations per dayOver 200,000 developers have submitted some sort of Facebook application using basic programming skills and there are over 15,000 official appsUsers can add up to 20 friends per dayFacebook apps can be considered as XHTML snippets that inherit all the properties of web applications

Ideal Exploitation Platform?Social networks have intrinsic properties that make them ideal to be exploited by an adversary:Difficult to police: very large and distributed user baseTrust network: clusters of users sharing the same social interests developing trust with each otherPlatform openness for developing applications that are attractive the general users who will install them

Other Precedents?One of the ways to think about the broader risks of social networking against critical infrastructure is related to the problems of state-sponsored attackers“People’s War” concept a la Dragon Bytes – many home computers used as soldiersSimilar problem seen with Gnutella used as a DDOS platformA rogue social network app could be used in the same manner or worse

Two Social Networking Sites91 Percent of Phishing AttacksIn an analysis of cyber crime activity in the 2nd half of 2007, security vendor Symantec Corp. found that two social networking sites together were the target of 91 percent of U.S.-based phishing Web sites. Social networking sites also were the leading targets of phishing sites located in four other countries listed by Symantec in its phishing Top 10. Source: Symantec Corp.Hijacked social networking pages often are used to host malicious software or "malware" directly or to host links phishing or malware sites that are then advertised in messages sent to all of the contacts in the victim's social network.

Top Targeted Phishing Sites

Why Don’t We Just Ban It AllBanning public social networking sites from corporate use may help with the distraction factor and with some of the other technical issues, but..In many cases, there is just too much personal information posted on these sitesInformation such as the full names of parents, pets, schools and other “keys” that are used to unlock personal and professional accountsEmbarrassing or inappropriate pictures that could be used in blackmail scenarios (think Cold War)Lifestyle information that may create personal or professional problems

Taking It to the ExtremeIf an adversary were able to develop an application as successful as FunWall, for example, a victim host would have to cope with about 23 Mbit/sec of unsolicited traffic and nearly 248GB a day of unwanted dataOf course, this assumes a lot about bandwidth and the lack of proper network and security management…But, adversaries don’t need all that bandwidth.

Here's a look at the seven most lethal social networks hacks: 1) Impersonation and targeted personal attacks 2) Spam and bot infections3) WeaponizedOpenSocial and other social networking applications4) Crossover of personal to professional online presence 5) XSS, CSRF attacks 6) Identity theft 7) Corporate espionage Social Networking

Social Networking Because of its huge base -- last month Facebook said it had more than 300 million users -- the site is a frequent target for hackers and identity thieves10-28-2009Researchers at several security firms have uncovered a spam campaign targeting Facebook users. The e-mails, which pose as communications from Facebook about password resets, contain a nasty downloader that ultimately makes users part of a notorious botnet.10-02-2009Facebook Attackers May Have Cracked CAPTCHAResearchers at AVG Technologies may have uncovered a scheme by attackers to circumvent the CAPTCHA protections on Facebook to create fraudulent accounts.02-09-2009Rik Ferguson, senior security advisor for Trend Micro, said the social networking Web site based in Palo Alto, Calif., has been hit in the past week with four malicious applications and a new version of the Koobface virus that was first detected in December 2008, the BBC reported Monday

Avoiding Social Engineering and Phishing AttacksHow do you avoid being a victim?Be suspicious of unsolicited phone calls, visits, or email messages from individuals asking about employees or other internal information. If an unknown individual claims to be from a legitimate organization, try to verify his or her identity directly with the company. Do not provide personal information or information about your organization, including its structure or networks, unless you are certain of a person's authority to have the information. Do not reveal personal or financial information in email, and do not respond to email solicitations for this information. This includes following links sent in email. Don't send sensitive information over the Internet before checking a website's security (see Protecting Your Privacy for more information). Pay attention to the URL of a website. Malicious websites may look identical to a legitimate site, but the URL may use a variation in spelling or a different domain (e.g., .com vs. .net). Social Networking

If you are unsure whether an email request is legitimate, try to verify it by contacting the company directly. Do not use contact information provided on a website connected to the request; instead, check previous statements for contact information. Information about known phishing attacks is also available online from groups such as the Anti-Phishing Working Group (http://www.antiphishing.org). Install and maintain anti-virus software, firewalls, and email filters to reduce some of this traffic (see Understanding Firewalls, Understanding Anti-Virus Software, and Reducing Spam for more information). Take advantage of any anti-phishing features offered by your email client and web browser. Social Networking

http://www.staysafeonline.org/blog/staying-safe-social-media-web-siteshttp://www.thetechherald.com/article.php/200938/4434http://www.us-cert.gov/cas/tips/ST04-014.htmlhttp://www.justaskgemalto.com/us/focus/managing-your-digital-identity-social-media-siteshttp://edition.cnn.com/2009/TECH/07/16/twitter.hack/Social Networking