Feeds

Social net sites do wonders for crooks, spooks and bosses

'Computers are making people easier to use everyday'

Intelligent flash storage arrays

RSA Europe Social networks make obtaining sensitive background information on people as a prelude to stealing their identities – and running attacks on corporations – easier than ever before.

Ira Winkler, president of ISAG (Internet Security Advisors Group), an ex-NSA officer and cybercrime guru, has called for increased security awareness training. "People don't realise what they are putting out there," he said. "Computers are making people easier to use everyday."

Speaking at the RSA Europe conference in London on Wednesday, Winkler outlined a range of attacks that social networking might enable. Information on LinkedIn, for example, has been used as a prelude to targeted attacks against corporates or government agencies as part of the expanding list of so-called Advanced Persistent Threat-style (APT) attacks commonly blamed on China. Lower-level criminals can use information on social networks such as Facebook to guess the answers to password reset questions, for example. Worse still, 4Square users are giving away their location every time they log in to a venue, revealing to potential burglars that they are away from home in the process.

Much of this type of activity is wrongly described as social engineering, according to Winkler. The security guru said the term social engineering has been bastardised. Its original meaning referred to an interaction with people where they would be directly manipulated into performing actions or giving away confidential information. The bastardised term is now misapplied to "check this out" lures in mass-mailed computer viruses or even to the lifting of sensitive information consumers have unwittingly left on social networking sites, he says.

He also pointed out that few stop to think that current or potential employers might scan their Facebook profiles, which reveal details of drunken parties or time taken off work when they are supposedly sick.

Content-filtering tools for social networks don't exist as yet. In the absence of such tools, Winkler favours security awareness training for users, which he argues is sorely needed.

"You can have no expectation of privacy for anything you put on the internet," Winkler. "The test has to be: do you want your worst possible enemy to see the information you are putting online?" ®

Security for virtualized datacentres

More from The Register

next story
Knock Knock tool makes a joke of Mac AV
Yes, we know Macs 'don't get viruses', but when they do this code'll spot 'em
Feds seek potential 'second Snowden' gov doc leaker – report
Hang on, Ed wasn't here when we compiled THIS document
Why weasel words might not work for Whisper
CEO suspends editor but privacy questions remain
DEATH by PowerPoint: Microsoft warns of 0-day attack hidden in slides
Might put out patch in update, might chuck it out sooner
BlackEnergy crimeware coursing through US control systems
US CERT says three flavours of control kit are under attack
prev story

Whitepapers

Why and how to choose the right cloud vendor
The benefits of cloud-based storage in your processes. Eliminate onsite, disk-based backup and archiving in favor of cloud-based data protection.
Getting started with customer-focused identity management
Learn why identity is a fundamental requirement to digital growth, and how without it there is no way to identify and engage customers in a meaningful way.
Reg Reader Research: SaaS based Email and Office Productivity Tools
Read this Reg reader report which provides advice and guidance for SMBs towards the use of SaaS based email and Office productivity tools.
Saudi Petroleum chooses Tegile storage solution
A storage solution that addresses company growth and performance for business-critical applications of caseware archive and search along with other key operational systems.
Internet Security Threat Report 2014
An overview and analysis of the year in global threat activity: identify, analyze, and provide commentary on emerging trends in the dynamic threat landscape.