Feeds

Twitter, Facebook urged to improve security

'Vulnerable' defined in less than 140 characters

Remote control for virtualized desktops

Social networking sites such as Twitter and Facebook have become feeding grounds for cybercrime.

A threat report by net security firm Sophos warns that Web 2.0 companies are too focused at growing their user bases, at the possible expense of paying attention towards defending their existing customers from internet risks.

Sophos reckons a quarter of organisations have been exposed to spam, phishing or malware attacks via sites such as Twitter, Facebook, LinkedIn and MySpace.

"Web 2.0 companies need to examine their systems and determine how, now they have gathered a huge number of members, they are going to protect them from virus writers, identity thieves, spammers and scammers," said Graham Cluley, senior technology consultant at Sophos. "The honeymoon period of these sites is over, and personally identifiable information is at risk as a result of constant attacks that the websites are simply not mature enough to protect against."

Cluley told El Reg that Twitter and Facebook ought to scan for links to sites hosting malware or promoted via spam messages. Both sites also ought to force users to use stronger (harder to guess) passwords and do more to prevent cross-site scripting attacks, he added.

Figures from Sophos also point to the growth in scareware scams, where users are tricked into buying rogue security packages of little or no utility on the basis of false security scans. Sophos picked up an average of fifteen such scareware sites per day during the first half of 2009, a three-fold increase over the same period last year.

Sophos now catalogues 22.5 million different samples of malware, almost double the level it recorded in June 2008. Around 40,000 new suspicious files are examined by security analysts at Sophos every day.

The firm discovers an infected webpage once every 3.6 seconds, on average, four times faster than in the first half of 2008. Two years ago, 50 per cent of all web-based malware was hosted in China. This figure dropped to just 14.7 per cent in the first half of this year, with the USA eclipsing China as the biggest single locus of drive-by-download threats (39.6 per cent).

Compromised US computers also make the single greatest contribution to spam (15.7 per cent), which cumulatively makes up nine in 10 (89.7 per cent) of all business email. The latest edition of Sophos's Security Threat Report can be found here (registration required). A summary can be found here. ®

Intelligent flash storage arrays

More from The Register

next story
Regin: The super-spyware the security industry has been silent about
NSA fingered as likely source of complex malware family
Why did it take antivirus giants YEARS to drill into super-scary Regin? Symantec responds...
FYI this isn't just going to target Windows, Linux and OS X fans
Privacy bods offer GOV SPY VICTIMS a FREE SPYWARE SNIFFER
Looks for gov malware that evades most antivirus
Home Office: Fancy flogging us some SECRET SPY GEAR?
If you do, tell NOBODY what it's for or how it works
Patch NOW! Microsoft slings emergency bug fix at Windows admins
Vulnerability promotes lusers to domain overlords ... oops
HACKERS can DELETE SURVEILLANCE DVRS remotely – report
Hikvision devices wide open to hacking, claim securobods
'Regin': The 'New Stuxnet' spook-grade SOFTWARE WEAPON described
'A degree of technical competence rarely seen'
Syrian Electronic Army in news site 'hack' POP-UP MAYHEM
Gigya redirect exploit blamed for pop-rageous ploy
prev story

Whitepapers

Designing and building an open ITOA architecture
Learn about a new IT data taxonomy defined by the four data sources of IT visibility: wire, machine, agent, and synthetic data sets.
Getting started with customer-focused identity management
Learn why identity is a fundamental requirement to digital growth, and how without it there is no way to identify and engage customers in a meaningful way.
5 critical considerations for enterprise cloud backup
Key considerations when evaluating cloud backup solutions to ensure adequate protection security and availability of enterprise data.
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?
Driving business with continuous operational intelligence
Introducing an innovative approach offered by ExtraHop for producing continuous operational intelligence.