Feeds

Facebook defends security strategy

Shy social network responds to criticism

Choosing a cloud hosting partner with confidence

Down with this sort of thing

Facebook said it is constantly improving the level of account protection offered to users, citing its introduction of one-time passwords back in October 2010, a development designed to make it safer for users to use public computers to access the service.

The social network goes on to list its user education programmes, which are geared to improving the security awareness levels of users.

These initiatives include updating the 3.6 million people who have liked the Facebook Security Page, hundreds of thousands of which have taken our "Stop. Think. Connect." quiz on the Page, which we developed with National Cyber Security Alliance and the Anti-Phishing Working Group; as well as the education we do through the product, for example, when we detect that an account is compromised by phishing or malware, we put the owner through a remediation/education process that includes a free McAfee virus scan.

When a person clicks on a link that we can't verify, or that we think might be suspicious, we pop an interstitial warning.

We put these points to Sophos, which said it stood by the main findings of its original report, and argued that the social network could and should do more to improve the security of its users.

"I definitely feel that Facebook could be doing more to both better secure their users, and to ensure that privacy is treated as a higher priority," Graham Cluley, senior technology consultant at Sophos, told El Reg.

Facebook may talk a good game but a quick search (viewable only if logged into Facebook and safe providing you don't click on the links) shows hundreds of victims have installed a rogue app that falsely promises the ability to "see who has viewed your profile".

Facebook ought to have someone searching for such scams and stamping them out, something that isn't happening as yet. "Often I see these scams spreading for days on end, with no obvious action taken by Facebook," Cluley said.

Careful now

According to Sophos, the social network could employ a round-the-clock security response team. Some have suggested Apple-style pre-approval of apps would drastically reduce, if not eliminate, the volume of crud circulating on Facebook. However, Cluley said such an approach was hard to apply to Facebook's platform.

"Pre-approval of apps is tricky, because they are web-based and contain content that is not hosted on Facebook's own servers," Cluley explained. "In other words, the bad guys could change it any time - turning a good app into a rogue one."

What might work better is some form of white-listing or restricting the ability to access sensitive data to already trusted developers, Cluley explained.

"Each app could be submitted for profiling to Facebook, who would create a matrix of what data it requested to access from the user, and which webpages it uses content from. If these changed at any point then the app would no longer be approved, and be sent back to Facebook's sinbin team for checking.

"Better than that would be for Facebook to only allow apps that came from approved developers to access sensitive information or post to users' walls."

Cluley said Facebook introduced an optional app verification program in November 2008, only to quietly kill it off a year later.

Facebook ought to consider reviving the program, said Cluley. "If developers had to pay to become official developers for the Facebook platform, and if not being an official developer meant you weren't able to hit Facebook users, then we'd see an instant dramatic drop in the attacks."

Sophos suggested that Facebook ought to be more proactive in using its security page as an early warning system on scams, as part of a broader program targeted at curtailing rogue apps and other security threats.

"There's a sliding scale of things that Facebook could do to counter the problem of rogue apps - ranging from faster response to stricter conditions about who and who can't write Facebook applications," Cluley concluded. "What's clear is that their current approach isn't working." ®

Beginner's guide to SSL certificates

More from The Register

next story
FYI: OS X Yosemite's Spotlight tells Apple EVERYTHING you're looking for
It's on by default – didn't you read the small print?
Russian hackers exploit 'Sandworm' bug 'to spy on NATO, EU PCs'
Fix imminent from Microsoft for Vista, Server 2008, other stuff
Microsoft pulls another dodgy patch
Redmond makes a hash of hashing add-on
'LulzSec leader Aush0k' found to be naughty boy not worthy of jail
15 months home detention leaves egg on feds' faces as they grab for more power
China is ALREADY spying on Apple iCloud users, claims watchdog
Attack harvests users' info at iPhone 6 launch
Carders punch holes through Staples
Investigation launched into East Coast stores
Kill off SSL 3.0 NOW: HTTPS savaged by vicious POODLE
Pull it out ASAP, it is SWISS CHEESE
prev story

Whitepapers

Forging a new future with identity relationship management
Learn about ForgeRock's next generation IRM platform and how it is designed to empower CEOS's and enterprises to engage with consumers.
Cloud and hybrid-cloud data protection for VMware
Learn how quick and easy it is to configure backups and perform restores for VMware environments.
Three 1TB solid state scorchers up for grabs
Big SSDs can be expensive but think big and think free because you could be the lucky winner of one of three 1TB Samsung SSD 840 EVO drives that we’re giving away worth over £300 apiece.
Reg Reader Research: SaaS based Email and Office Productivity Tools
Read this Reg reader report which provides advice and guidance for SMBs towards the use of SaaS based email and Office productivity tools.
Security for virtualized datacentres
Legacy security solutions are inefficient due to the architectural differences between physical and virtual environments.