Feeds

Facebook message security risks 'open door to Web 2.0 botnet'

Nowhere is safe! Nowhere!

Reducing security risks from open source software

Security watchers have already begun fretting about the security implications of Facebook's new messaging system, warning that compromised accounts might be used to create potent Web 2.0 botnets.

The system brings together Facebook messages, instant messaging chat and SMS messages in one location, a development that increases the value of compromised accounts to spammers while simultaneously increasing the number of ways to attack accounts (or the attack surface).

"Facebook accounts will now be linked with many more people in the users' social circles - opening up new opportunities for identity fraudsters to launch attacks," warned net security firm Sophos.

Miscreants have been using compromised accounts to spread spam since Facebook first opened up to general usage. Spam sent via the social network often invokes survey scam and malware lures as well as the occasional penis pill advert.

Users are more likely to open and trust a message which appears to have been sent by someone they know - one of their Facebook friends - a factor that makes the platform more attractive to spammers and other assorted cybercrooks.

Much earlier attention has focused on the strong likelihood that @facebook.com users will receive spam messages from external parties. But the greater threat, according to Sophos, comes from the possibility that cybercrooks will use phishing to compromise Facebook messaging accounts.

"Careless password security and other factors could lead to the creation of Web 2.0 botnet," a Sophos spokesman said.

Until Facebook rolls out plans to apply always-on encryption, users accounts also remain exposed to cookie capture compromise in open Wi-Fi networks, a risk graphically illustrated with the recent release of Firesheep.

Facebook has made use of third-party anti-spam services and in-house technology in tackling the problem of spam that already exists on Facebook. However, Sophos reckons these ad-hoc campaigns have amounted to an exercise in "whack-a-mole" that has failed to address underlying problems.

Sophos is also concerned that Facebook's messaging system will permanently archive content, outside of the control of users.

The net security firm has put together a guide designed to help users understand the potential security implications of signing up to the service, which can be found here.

Many people are likely to use Facebook's messaging system bot at home and at work. According to stats from next-generation firewall vendor Palo Alto Networks, Facebook Mail has appearing consistently in the top five most frequently used webmail applications.

Use of the application is dwarfed by Gmail and Hotmail usage within corporates, but usage within corporates has grown from 0.2 per cent to three per cent over the last two years. ®

Mobile application security vulnerability report

More from The Register

next story
LibreSSL RNG bug fix: What's all the forking fuss about, ask devs
Blow to bit-spitter 'tis but a flesh wound, claim team
Microsoft: You NEED bad passwords and should re-use them a lot
Dirty QWERTY a perfect P@ssword1 for garbage websites
Manic malware Mayhem spreads through Linux, FreeBSD web servers
And how Google could cripple infection rate in a second
NUDE SNAPS AGENCY: NSA bods love 'showing off your saucy selfies'
Swapping other people's sexts is a fringe benefit, says Snowden
Own a Cisco modem or wireless gateway? It might be owned by someone else, too
Remote code exec in HTTP server hands kit to bad guys
British data cops: We need greater powers and more money
You want data butt kicking, we need bigger boots - ICO
Crooks fling banking Trojan at Japanese smut site fans
Wait - they're doing online banking with an unpatched Windows PC?
NIST told to grow a pair and kick NSA to the curb
Lrn2crypto, oversight panel tells US govt's algorithm bods
prev story

Whitepapers

Top three mobile application threats
Prevent sensitive data leakage over insecure channels or stolen mobile devices.
The Essential Guide to IT Transformation
ServiceNow discusses three IT transformations that can help CIO's automate IT services to transform IT and the enterprise.
Mobile application security vulnerability report
The alarming realities regarding the sheer number of applications vulnerable to attack, and the most common and easily addressable vulnerability errors.
How modern custom applications can spur business growth
Learn how to create, deploy and manage custom applications without consuming or expanding the need for scarce, expensive IT resources.
Consolidation: the foundation for IT and business transformation
In this whitepaper learn how effective consolidation of IT and business resources can enable multiple, meaningful business benefits.