Facebook defends security strategy

Down with this sort of thing

Facebook said it is constantly improving the level of account protection offered to users, citing its introduction of one-time passwords back in October 2010, a development designed to make it safer for users to use public computers to access the service.

The social network goes on to list its user education programmes, which are geared to improving the security awareness levels of users.

These initiatives include updating the 3.6 million people who have liked the Facebook Security Page, hundreds of thousands of which have taken our "Stop. Think. Connect." quiz on the Page, which we developed with National Cyber Security Alliance and the Anti-Phishing Working Group; as well as the education we do through the product, for example, when we detect that an account is compromised by phishing or malware, we put the owner through a remediation/education process that includes a free McAfee virus scan.

When a person clicks on a link that we can't verify, or that we think might be suspicious, we pop an interstitial warning.

We put these points to Sophos, which said it stood by the main findings of its original report, and argued that the social network could and should do more to improve the security of its users.

"I definitely feel that Facebook could be doing more to both better secure their users, and to ensure that privacy is treated as a higher priority," Graham Cluley, senior technology consultant at Sophos, told El Reg.

Facebook may talk a good game but a quick search (viewable only if logged into Facebook and safe providing you don't click on the links) shows hundreds of victims have installed a rogue app that falsely promises the ability to "see who has viewed your profile".

Facebook ought to have someone searching for such scams and stamping them out, something that isn't happening as yet. "Often I see these scams spreading for days on end, with no obvious action taken by Facebook," Cluley said.

Careful now

According to Sophos, the social network could employ a round-the-clock security response team. Some have suggested Apple-style pre-approval of apps would drastically reduce, if not eliminate, the volume of crud circulating on Facebook. However, Cluley said such an approach was hard to apply to Facebook's platform.

"Pre-approval of apps is tricky, because they are web-based and contain content that is not hosted on Facebook's own servers," Cluley explained. "In other words, the bad guys could change it any time - turning a good app into a rogue one."

What might work better is some form of white-listing or restricting the ability to access sensitive data to already trusted developers, Cluley explained.

"Each app could be submitted for profiling to Facebook, who would create a matrix of what data it requested to access from the user, and which webpages it uses content from. If these changed at any point then the app would no longer be approved, and be sent back to Facebook's sinbin team for checking.

"Better than that would be for Facebook to only allow apps that came from approved developers to access sensitive information or post to users' walls."

Cluley said Facebook introduced an optional app verification program in November 2008, only to quietly kill it off a year later.

Facebook ought to consider reviving the program, said Cluley. "If developers had to pay to become official developers for the Facebook platform, and if not being an official developer meant you weren't able to hit Facebook users, then we'd see an instant dramatic drop in the attacks."

Sophos suggested that Facebook ought to be more proactive in using its security page as an early warning system on scams, as part of a broader program targeted at curtailing rogue apps and other security threats.

"There's a sliding scale of things that Facebook could do to counter the problem of rogue apps - ranging from faster response to stricter conditions about who and who can't write Facebook applications," Cluley concluded. "What's clear is that their current approach isn't working." ®