Feeds

Grifters find rich pickings on social networking sites

Phishermans' friend

The essential guide to IT transformation

Social networking sites are creating a means for hackers and conmen to worm their way into the confidence of users.

Sites such as LinkedIn can be used to create a veneer of trust that leaves internet users and business at a greater risk of attack, according to a study by Danish security firm CSIS. Dennis Rand, a security researcher at CSIS, created a fictitious entry on the LinkedIn network before inviting random and unknown users of LinkedIn to join his private network. By posing as an ex-employee of "targeted" firms he was able to prompt real workers from these firms into establishing connections.

Within a few weeks Rand created a network of 1340 trusted connections. In a research paper, Threats when using online social networks (PDF), Rand explains how information gleaned through this network might be used to harvest email addresses for spamming or worse. The "blind trust" built into social networks might be abused to send messages containing links to malicious code that are more likely to be accepted because they come from a "trusted" source, for example.

Other risks include the possibility that sales staff might take sensitive sales prospect contact lists with them when they change jobs. Just putting these contacts online creates a data leak risk.

Rand's study focused on LinkedIn, a business-focused network with around 10m registered users, but the risks highlighted apply to social networking sites as a whole. He argues firms need to update their security policies to contain rules for using social networking sites.

Consumers also need to be wary about treating social networking sites as a safe environment. According to a recent Indiana University study, 72 per cent of recipients of spoofed phishing emails from social networking acquaintances failed to twig that something was amiss. But just 15 per cent failed to realise that a similar message sent by a stranger might be a scam. Data harvested from social networking sites might be used to personalise scam messages, thus increasing the plausibility of so-called spear phishing attacks.

In a recent interview, conducted by ha.ckers.org, a phishing fraudstere claims e could rake in between $3,000-$4,000 a day, by targeting users of social networking sites such as MySpace, Facebook and LinkedIn.

The stock-in-trade of this conman, who goes by the name 'Lithium', is to capture of login credential using bogus social networking sites, designed to resemble the real thing. He then accesses a victim's email account using captured login information, taking advantage of the fact that users often use the same password for multiple sites. Access to email accounts can be in turn be used to access any associated PayPal or eBay accounts.

This is a plausible enough scenario, even though Lithium's claimed spoils seem high. Perhaps the 19 year-old self-confessed fraudster feels the need to brag about his earnings. ®

Next gen security for virtualised datacentres

More from The Register

next story
Snowden on NSA's MonsterMind TERROR: It may trigger cyberwar
Plus: Syria's internet going down? That was a US cock-up
Who needs hackers? 'Password1' opens a third of all biz doors
GPU-powered pen test yields more bad news about defences and passwords
e-Borders fiasco: Brits stung for £224m after US IT giant sues UK govt
Defeat to Raytheon branded 'catastrophic result'
Microsoft cries UNINSTALL in the wake of Blue Screens of Death™
Cache crash causes contained choloric calamity
Germany 'accidentally' snooped on John Kerry and Hillary Clinton
Dragnet surveillance picks up EVERYTHING, USA, m'kay?
Linux kernel devs made to finger their dongles before contributing code
Two-factor auth enabled for Kernel.org repositories
prev story

Whitepapers

5 things you didn’t know about cloud backup
IT departments are embracing cloud backup, but there’s a lot you need to know before choosing a service provider. Learn all the critical things you need to know.
Implementing global e-invoicing with guaranteed legal certainty
Explaining the role local tax compliance plays in successful supply chain management and e-business and how leading global brands are addressing this.
Build a business case: developing custom apps
Learn how to maximize the value of custom applications by accelerating and simplifying their development.
Rethinking backup and recovery in the modern data center
Combining intelligence, operational analytics, and automation to enable efficient, data-driven IT organizations using the HP ABR approach.
Next gen security for virtualised datacentres
Legacy security solutions are inefficient due to the architectural differences between physical and virtual environments.