Feeds

Social net sites do wonders for crooks, spooks and bosses

'Computers are making people easier to use everyday'

Beginner's guide to SSL certificates

RSA Europe Social networks make obtaining sensitive background information on people as a prelude to stealing their identities – and running attacks on corporations – easier than ever before.

Ira Winkler, president of ISAG (Internet Security Advisors Group), an ex-NSA officer and cybercrime guru, has called for increased security awareness training. "People don't realise what they are putting out there," he said. "Computers are making people easier to use everyday."

Speaking at the RSA Europe conference in London on Wednesday, Winkler outlined a range of attacks that social networking might enable. Information on LinkedIn, for example, has been used as a prelude to targeted attacks against corporates or government agencies as part of the expanding list of so-called Advanced Persistent Threat-style (APT) attacks commonly blamed on China. Lower-level criminals can use information on social networks such as Facebook to guess the answers to password reset questions, for example. Worse still, 4Square users are giving away their location every time they log in to a venue, revealing to potential burglars that they are away from home in the process.

Much of this type of activity is wrongly described as social engineering, according to Winkler. The security guru said the term social engineering has been bastardised. Its original meaning referred to an interaction with people where they would be directly manipulated into performing actions or giving away confidential information. The bastardised term is now misapplied to "check this out" lures in mass-mailed computer viruses or even to the lifting of sensitive information consumers have unwittingly left on social networking sites, he says.

He also pointed out that few stop to think that current or potential employers might scan their Facebook profiles, which reveal details of drunken parties or time taken off work when they are supposedly sick.

Content-filtering tools for social networks don't exist as yet. In the absence of such tools, Winkler favours security awareness training for users, which he argues is sorely needed.

"You can have no expectation of privacy for anything you put on the internet," Winkler. "The test has to be: do you want your worst possible enemy to see the information you are putting online?" ®

Intelligent flash storage arrays

More from The Register

next story
You really need to do some tech support for Aunty Agnes
Free anti-virus software, expires, stops updating and p0wns the world
Regin: The super-spyware the security industry has been silent about
NSA fingered as likely source of complex malware family
You stupid BRICK! PCs running Avast AV can't handle Windows fixes
Fix issued, fingers pointed, forums in flames
Privacy bods offer GOV SPY VICTIMS a FREE SPYWARE SNIFFER
Looks for gov malware that evades most antivirus
Patch NOW! Microsoft slings emergency bug fix at Windows admins
Vulnerability promotes lusers to domain overlords ... oops
HACKERS can DELETE SURVEILLANCE DVRS remotely – report
Hikvision devices wide open to hacking, claim securobods
prev story

Whitepapers

Why and how to choose the right cloud vendor
The benefits of cloud-based storage in your processes. Eliminate onsite, disk-based backup and archiving in favor of cloud-based data protection.
Forging a new future with identity relationship management
Learn about ForgeRock's next generation IRM platform and how it is designed to empower CEOS's and enterprises to engage with consumers.
Designing and building an open ITOA architecture
Learn about a new IT data taxonomy defined by the four data sources of IT visibility: wire, machine, agent, and synthetic data sets.
How to determine if cloud backup is right for your servers
Two key factors, technical feasibility and TCO economics, that backup and IT operations managers should consider when assessing cloud backup.
Reg Reader Research: SaaS based Email and Office Productivity Tools
Read this Reg reader report which provides advice and guidance for SMBs towards the use of SaaS based email and Office productivity tools.