Facebook defends security strategy

Original URL: https://www.theregister.com/2011/01/21/facebook_security_analysis/

Shy social network responds to criticism

Posted in Security, 21st January 2011 16:01 GMT

Analysis Facebook has defended its record in thwarting rogue applications and other security in the face of criticism from security firms that it ought to adopt tighter application controls.

The dominant social network disputes findings from a threat report by UK-based net security firm Sophos, released earlier this week, that spam, malware and other attacks have become more effective against Facebook users over the last year.

Facebook reckons the opposite is true while disputing the methodology adopted by Sophos which it said looked, for example, at the volume of spam sent to Facebook users instead of the volume that reached their in-boxes.

Facebook said: "If your spam filter catches all the spam, does it matter that your filter caught 10 per cent more?"

The social networking site reckons less than three per cent of communications on Facebook are spam, compared to industry estimates that email spam makes up 90 per cent of all electronic messages. The implication is that Sophos is focusing on the wrong problem.

Unfriending rogues

Survey scams have become an almost daily occurrence on Facebook over recent months. Typically they use the lure of an application that a potential victim's friend has been tricked into installing, such as a 'Dislike' button or a link to shocking (invariably bogus) news about a celebrity.

Instead of getting the promised content, victims are invited to navigate their way through a thicket of time-wasting surveys. Scammers earn a kick-back for each victim as affiliates of unethical marketing firms.

More ambitious (and lucrative) scams attempt to trick victims into supplying their mobile number, before signing up to a premium rate text messaging service of questionable utility.

The scams take advantage of human stupidity rather than web security vulnerabilities. Both Sophos and Facebook agree that user education is part of the solution, but the two are split on whether Facebook itself could do more to tighten up its controls on how applications are released onto its platform.

In a statement responding to Sophos' report, Facebook said it has plenty of controls already that limit access to information.

We have built extensive controls into the product, so that now when you add an application it only gets access to very limited data and the user must approve each additional type of data (so we do more than anyone else to educate users about passage of data, and force disclosure and user consent for each category beyond the basics).
We have a dedicated team that does robust review of all third party applications, using a risk based approach. So, that means that we first look at velocity/number of users/types of data shared, and prioritise. This ensures that the team is focused on addressing the biggest risks, rather than just doing a cursory review at the time that an app is first launched.

We make sure that we act swiftly to remove/sanction potentially bad applications before they gain access to data, and involve law enforcement and file civil actions if there is a problem.

Down with this sort of thing

Facebook said it is constantly improving the level of account protection offered to users, citing its introduction of one-time passwords back in October 2010, a development designed to make it safer for users to use public computers to access the service.

The social network goes on to list its user education programmes, which are geared to improving the security awareness levels of users.

These initiatives include updating the 3.6 million people who have liked the Facebook Security Page, hundreds of thousands of which have taken our "Stop. Think. Connect." quiz on the Page, which we developed with National Cyber Security Alliance and the Anti-Phishing Working Group; as well as the education we do through the product, for example, when we detect that an account is compromised by phishing or malware, we put the owner through a remediation/education process that includes a free McAfee virus scan.
When a person clicks on a link that we can't verify, or that we think might be suspicious, we pop an interstitial warning.

We put these points to Sophos, which said it stood by the main findings of its original report, and argued that the social network could and should do more to improve the security of its users.

"I definitely feel that Facebook could be doing more to both better secure their users, and to ensure that privacy is treated as a higher priority," Graham Cluley, senior technology consultant at Sophos, told El Reg.

Facebook may talk a good game but a quick search (viewable only if logged into Facebook and safe providing you don't click on the links) shows hundreds of victims have installed a rogue app that falsely promises the ability to "see who has viewed your profile".

Facebook ought to have someone searching for such scams and stamping them out, something that isn't happening as yet. "Often I see these scams spreading for days on end, with no obvious action taken by Facebook," Cluley said.

Careful now

According to Sophos, the social network could employ a round-the-clock security response team. Some have suggested Apple-style pre-approval of apps would drastically reduce, if not eliminate, the volume of crud circulating on Facebook. However, Cluley said such an approach was hard to apply to Facebook's platform.

"Pre-approval of apps is tricky, because they are web-based and contain content that is not hosted on Facebook's own servers," Cluley explained. "In other words, the bad guys could change it any time - turning a good app into a rogue one."

What might work better is some form of white-listing or restricting the ability to access sensitive data to already trusted developers, Cluley explained.

"Each app could be submitted for profiling to Facebook, who would create a matrix of what data it requested to access from the user, and which webpages it uses content from. If these changed at any point then the app would no longer be approved, and be sent back to Facebook's sinbin team for checking.

"Better than that would be for Facebook to only allow apps that came from approved developers to access sensitive information or post to users' walls."

Cluley said Facebook introduced an optional app verification program in November 2008, only to quietly kill it off a year later.

Facebook ought to consider reviving the program, said Cluley. "If developers had to pay to become official developers for the Facebook platform, and if not being an official developer meant you weren't able to hit Facebook users, then we'd see an instant dramatic drop in the attacks."

Sophos suggested that Facebook ought to be more proactive in using its security page as an early warning system on scams, as part of a broader program targeted at curtailing rogue apps and other security threats.

"There's a sliding scale of things that Facebook could do to counter the problem of rogue apps - ranging from faster response to stricter conditions about who and who can't write Facebook applications," Cluley concluded. "What's clear is that their current approach isn't working." ®