Feeds

Facebook flashes its One Tool To Rule Them All in security threat analysis

Code, or it didn't happen

Securing Web Applications Made Simple and Scalable

Facebook has bragged about a new internal tool that combines all sorts of live data on internet security threats – such as any new malware doing the rounds and known dodgy URLS.

The social network's engineers said the utility, imaginatively dubbed ThreatData, collects software nasties shared by researchers and also throws in intelligence gathered by Facebook plus information it buys from infosec firms.

Unfortunately, these sources each deliver their data in different ways, so ThreatData translates them into a common format. It then cross-references the data with its two existing security databases, Hive (which stores long-term threat data) and Scuba (which stores warnings received in the last few days).

It's just possible Facebook is building a security analysis framework for everyone to use, not just Menlo Park techies, and that ThreatData is the basis for this software.

For now, though, ThreatData remains behind closed doors, but we're told it's impressive, naturally: putting all the threat data under a single roof allows the social network to spot attacks and trends in plenty of time, even ahead of security research companies, Facebook claims.

"We decided we would employ our framework to construct a light-weight set of hashes expressly not detected by our chosen anti-virus product and feed those hashes directly into our custom security event management system," Mark Hammell, threat researcher at Facebook, said on Tuesday.

"The results have been impressive: we've detected both adware and malware installed on visiting vendor computers that no single anti-virus product could have found for us."

Hammell said that ThreatData had also allowed Facebook to tamp down malicious code much more quickly. Last summer, malware that made victims' feature-phones send premium-rate text messages hit Facebook customers, but a similar attack in December was crippled by ThreatData.

The utility is just for Facebook's internal use only at the moment, but a company spokesman reminded us that FB has in the past opened up its homegrown tech to the wider community under open source licenses. ®

Mobile application security vulnerability report

More from The Register

next story
HIDDEN packet sniffer spy tech in MILLIONS of iPhones, iPads – expert
Don't panic though – Apple's backdoor is not wide open to all, guru tells us
LibreSSL RNG bug fix: What's all the forking fuss about, ask devs
Blow to bit-spitter 'tis but a flesh wound, claim team
NEW, SINISTER web tracking tech fingerprints your computer by making it draw
Have you been on YouPorn lately, perhaps? White House website?
Manic malware Mayhem spreads through Linux, FreeBSD web servers
And how Google could cripple infection rate in a second
NUDE SNAPS AGENCY: NSA bods love 'showing off your saucy selfies'
Swapping other people's sexts is a fringe benefit, says Snowden
Own a Cisco modem or wireless gateway? It might be owned by someone else, too
Remote code exec in HTTP server hands kit to bad guys
British data cops: We need greater powers and more money
You want data butt kicking, we need bigger boots - ICO
prev story

Whitepapers

Reducing security risks from open source software
Follow a few strategies and your organization can gain the full benefits of open source and the cloud without compromising the security of your applications.
Consolidation: The Foundation for IT Business Transformation
In this whitepaper learn how effective consolidation of IT and business resources can enable multiple, meaningful business benefits.
Application security programs and practises
Follow a few strategies and your organization can gain the full benefits of open source and the cloud without compromising the security of your applications.
Boost IT visibility and business value
How building a great service catalog relieves pressure points and demonstrates the value of IT service management.
Consolidation: the foundation for IT and business transformation
In this whitepaper learn how effective consolidation of IT and business resources can enable multiple, meaningful business benefits.