Why phishers love Facebook
Posted: Tuesday, June 2 2009 at 04:00 am CT by Bob Sullivan
Behind every successful criminal computer hack a simple two-step process: gain trust, then exploit that trust with an attack. Computer criminals will tell you that gaining trust is the hard part. Consider a real-world parallel: Breaking into a bank is difficult. But if you befriend a guard, he’ll eventually let you walk right in through the front door.
That's why Facebook attacks are so easy, says Mary Landesman, senior researcher at computer security firm ScanSafe.
"Facebook users assume a level of trust they just should not assume when using the site," she said.
Phishing attacks have been popping up nearly every week on Facebook and other social sites like Twitter. Victims receive e-mails from friends with innocent-sounding messages, such as "click on this video." Those who are duped then surrender their login information on a rogue Web site, and then a criminal is off to the races with their identity.
People who would never fall for an old-fashioned phishing note are getting tripped up by Facebook phish for one simple reason: They trust the sender.
"People are pretty unguarded in the social networking environment," said Kevin Haley, director of Symantec Corp.'s security response team. "You figure you're surrounded by friends, so why have your guard up?"
Been frustrated while trying to use airline miles to get a plane ticket? Click to tell us about it; Bob Sullivan might share your story on the NBC Today show.
He likened Facebook attacks to scam artists that prey on church communities, where members typically share a high level of trust.
By creating what looks like a safe, fun environment, Facebook has created an ideal breeding ground for phishing attacks. In fact, some Facebook software even helps the cause. For example, Facebook makes it relatively easy to send messages to groups of “friends,” or to post notes that appear on their Web pages. That means one stolen login account can lead to a lot of trouble.
Worse yet, some of the techniques Facebook employs fly directly in the face of accepted security practices. Facebook regularly sends e-mail to users with links in the message. "To follow the comment thread, follow the link below," reads a typical note. Clicking on the link then prompts users to log in.
That is precisely the formula phishers use to trick victims into divulging their passwords -- an e-mail with a link that leads to a login page.
The Facebook method is a recipe for disaster. It's difficult for users to tell the difference between a legitimate Facebook message and a phishing e-mail. That's why many banks stopped sending e-mails with links years ago. And in general, that is why e-mail is no longer regarded as a secure form of communication -- outside the social networking universe, anyway.
But Facebook has trained their users to click on links in e-mail. And with the steady advance of third-party applications that require sharing of data, Facebook has trained users to play fast and loose with personal information, too.
"We've barely gotten users to the point where they have a basic understanding of passwords, and the idea of not using the same password for everything," Landesman said. “Facebook's use of e-mail and links "is a huge contributing factor (to the phishing problem).”
Facebook could make a simple change and stop many of these phishing attacks -- all notification e-mails could say simple "login on our homepage to see the message," for example, forcing users to always arrive at the site the old-fashioned way -- by typing in www.facebook.com in a Web browser's address bar.
This wouldn't eradicate phishing. E-mails within Facebook's system sent between users also include links, and these could also lead to trouble. Because linking to articles is such an important part of Facebook use, there's no realistic way for Facebook to abolish all e-mail links. But anyone who clicks on such a link sent from within Facebook's system wouldn't need to log in again. Over time, users would learn there's never a need to supply their password after clicking on a link, and wouldn't be primed to do so when a phisher’s e-mail arrived.
Things could be much worse
So far, most Facebook scams have been designed to steal passwords. But the next successful scam e-mail could be much worse. It could lead users to a cleverly designed Web site booby-trapped with a nasty virus that deletes files or finds its way around a victim’s PC and steals credit card information. Such an attack wouldn't require the victim to log in; merely visiting the page would be enough.
Of course, these are the same hazards that Internet users face every day -- supplying login information to imposter Web sites is bad, landing on booby-trapped Web sites even worse. But Facebook users are especially vulnerable, because they trust the site and their friends. The firm bears responsibility to act before the problem gets worse.
Facebook isn't entirely to blame, of course. Some of it is old-fashioned techno-naiveté. Users tend to be too trusting when a new technology arrives. Just two months ago we celebrated the 10th anniversary of the Melissa virus, the first e-mail worm that really shut down the entire computing world. Its method sounds quaint -- or even silly -- today. The Melissa message, which appeared to come from a co-worker or friend, read simply: "Here is that document you asked for ... don't show anyone else ;-)." Few Net users would fall for that trick in a standard e-mail today. But Facebook users are falling for very similar criminal tactics because they are working in a new medium. Many will have to touch this new stove and find out that, here too, they can be burned.
Here, too, Facebook is a victim of its own success. Mary Landesman points out that because nearly all Facebook messages are legitimate, recipients are much more likely to fall for the occasional e-mail trap. On the other hand, most traditional e-mail messages are spam (80 to 90 percent) and most inboxes are full of malicious messages, so consumers are much more wary when using regular e-mail.
"The fact that a majority of Facebook correspondence is still valid gives people a false sense of security," she said.
Facebook didn't ask for the job of Internet security cop, but that's the job the company has now. So far, phishing attempts have been clumsy, often marked by broken English and silly-looking URLs. One recent message urged recipients to click on a link with arcane labels like "Check 121.im."
But this weekend, a more sophisticated version included a link that looked like this:
http://www.facebook.com/l/;http://XXXXX.ru/?video_id=1319924"
(We've altered the link so it doesn't work)
Notice how believable the link is. It appears to link users to Facebook.com, when in fact it sends clickers to a Web site in Russia (Web browsers ignore all the characters before the semicolon in a link). Expect a steady progression in phishing techniques during the next few months.
Facebook is taking some actions to ward off disaster. It hired security firm MarkMonitor, which has experience in getting phishing Web sites removed from the Internet. The firm says it's already removed 240 phishing sites since the beginning of the year. When it discovers an ongoing phishing attack, Facebook reaches into users' inboxes and removes the harmful messages. Because it's a closed system, that technique is effective at preventing a large outbreak, at least on messages from within Facebook.
But the technology is limited and reactive. Facebook can only shut down an attack after it has started. And it can't remove notification e-mails that are sent outside its systems, leaving users who get those e-mails still vulnerable.
Facebook is hardly the only social networking site with a problem. Twitter, which was hit this weekend by the same Russian video phishing note as Facebook, also makes things easier for crooks. Last week, security firm Trend Micro said that 13,000 Twitter users were hit by the so-called “Twittercut” phish, which promised to help clickers quickly gain 1,000 new “followers.”
Because there are multiple domains that can be used to log in to a Twitter account, Landsman points out, users are less likely to be skeptical of a link to an unusual Web site.
But Facebook is the 800-pound gorilla with the 200 million users. It should set the tone for a new set of social networking security standards. It should stop pushing users to share information with third-party applications, stop using e-mail links as a main tool of communication, and work harder to educate users about the risks they’ll encounter while using the site.
RED TAPE WRESTLING TIPS
The oldest of all Web security advice still applies. Never click on a link you didn't expect, even if it comes from an old friend. Always type in Web addresses manually. Think before you click. Count to five if you have to.
Landesman also says that social network site users should avoid what she calls "promiscuous friending." The wider your network of friends, the more likely one of them will get hit with a virus and their computer will attack yours. Limit your friends and you'll limit your exposure.
Lawsuit a glimpse into 'worst' of the Web
EMAIL THIS
TRACKBACKS
Trackbacks are links to weblogs that reference this post. Like comments, trackbacks do no appear until approved by us. The trackback URL for this post is: http://www.typepad.com/services/trackback/6a00d83451b0aa69e201156fc1a275970c
advertisement
BUY BOB SULLIVAN'S NEW BOOK
Bob Sullivan's new book unmasks hundreds of hidden fees and offers step-by-step instructions on how to fight back. Order it here.
Also available as an audio book.
Red Tape Video
RED TAPE ARCHIVES
Why not got to public places to meet people? If you want to talk to a friend, invite her to lunch. If you want to see your mom, go to her place. No offense, but FB is for losers :)
Human, Real Life (Sent Jun 5, 2009 1:40:52 PM)
To Lame Book;
Facebook WILL completely delete your profile if you request it. I guess (like many people,) you're just too lazy to look up the "how to" on FB or Google.
Not Intellectually Lazy (Sent Jun 4, 2009 3:34:09 PM)
Hi Bob, this is a good reminder for all social media savvy consumers to use their judgment in responding to suspicious emails. Network Solutions had to deal with the phishing issue last year. Many of our customers received spam emails that looked like Network Solutions emails and we had to do some extensive customer outreach to educate them on phishing related concerns. With social networks becoming the hub for information exchange these days, there needs to a heightened awareness around data protection and privacy on Facebook, Twitter and the like. Better to be safe than sorry!
Shashi Bellamkonda
http://www.growsmartbusiness.com
Shashi Bellamkonda , Herndon , VA (Sent Jun 3, 2009 9:43:05 AM)
A word for using FB applications: be careful of anything which asks for your phone number (quizzes apps etc)
I got charged a chunk of change by a third party to my cel phone bill for responding to a request to "feed my virtual pet". My niece's account sent me a link to "feed her virtual pet" and I thought it would be nice since she is a kid. Lucky for me, my cel phone company was cooperative and removed all charges. I also reported the company responsible (in California) to the state's atty general after they refused to stop charging my phone. I am familiar with spammers, phishing scams, etc, but again, anyone can become a target.
Anonymous, Fort Lauderdale, FL (Sent Jun 2, 2009 5:26:00 PM)
FACEBOOK DOESN'T LET YOU DELETE PEOPLE.
WHY IS THIS DANGEROUS?
Because, lets say some friends remove their account -- but they are still linked to me. What stops a spammer becoming the same "friend" and saying "hey, I'm back on" -- I've also closed my account with Facebook twice since then and I still get emails from people who have "requested" that I join them. This is annoying. I can't delete myself, so I can still get emails from Facebook even if I don't want them to send me shit.
FACEBOOK MAKES IS MORE DANGEROUS BY STAYING CONNECTED TO PEOPLE WHO CANCEL THEIR ACCOUNTS AND DONT WANT EMAIL FROM THEM, AND BY NOT ALLOWING USERS TO CANCEL PEOPLE WHO LEAVE OR JUST BECOME CREEPY -- WHICH IS WHY I LEFT IN THE FIRST PLACE. FACBEOOK CAN FIX THAT SPAM-HOLE, BUT IT PREFERS TO KEEP NUMBERS OF USERS UP AND RUNNING. WHO ARE YOU SELLING NUMBERS TO, LAMEPAGE.COM? WHY CAN'T WE BLOCK FB SPAM AND BLOCK PEOPLE WHO CONTACT US UNDER FALSE PRETENSES?
LAME BOOK.
I've had 2 friends leave facebook but I would have no idea that the people who got in touch with me
Lame Book (Sent Jun 2, 2009 5:05:47 PM)
I have it set up so Facebook notifies me of nothing. The only thing that comes through is friend requests. If I don't know the person on a first name basis, the request is always ignored. Another helpful hint: don't click on ANY links on the Facebook page (don't get me started on how clicking on Tatoos nearly ruined my computer - rookie mistake). My Facebook literally looks like a family holiday dinner. Nothing more, nothing less. I have about 25 friends and that's enough for anyone.
Friends of friends aren't friends. Losers who knew me a hundred years ago aren't friends. Like I said: dinner table guests. That's it. And of course my page is blocked.
Repeal Proposition 8, San Diego, CA (Sent Jun 2, 2009 3:49:28 PM)
Many banks and credit card companies have resolved the phishing dilemma with a simple change to the login procedure. Usernames are separated from email addresses, and after entering your username, you are presented with an image - selected when you register for the account - that you select from a large array of images. If you begin to login to your account, and you see an image that is not the one you selected, you stop. So even if you click on the link in the email, you can stop before any real damage is done. Maybe there should be regulations that require this level of security for any web site where personal information is available (like FB, Twitter, MySpace, etc).
DB, Harrisburg PA (Sent Jun 2, 2009 2:27:22 PM)
As a cyber criminal let me share some things. Users get phished because they dont pay attention. If you are logged into FB and you click on a link and they ask you to log in again, well thank you because I just stole your credentials.
If you get a pop up that says you have a virus and you need to click on the link to fix it but you cant close the pop-up by clicking on the x then guess what, you dont have a virus but you will as soon as you click the download.
I used to do this on Myspace, but they figured out a way to block me, lucky FB and Twitter dont have the same security team
Now Ill share another little know fact... why do I phish or infect your computer with viruses? So I can use your contacts to send out spam. why spam? because spam = money. If I use your account to send a message to your friends and your friends go to my site, I get paid alot. Like say $100K a week. dont believe me... check out the explanation of how it work on spammertrack.com (site sucks but the owner gets it)
So with that I say, please click on those links and downloading my viruses and tell you friends to do the same because the economy is tough and my spam profit has dropped to about 50K a week. (by the way, my software deletes the spam messages I from your sent box but if you ask your friends they might be able to share what I have been sending out from your account.)
Idolin, Spammerville, USA (Sent Jun 2, 2009 1:40:37 PM)
Another tip: for websites where your login name is your email address (for example, Facebook), do not use the same password as you do for your email. That way, if you do fall for a phishing scam, the hacker won't be able to access your email as well. Yes, they'll get into your Facebook account, which is a pain, but at least they won't able hijack your email address and use it to spam (or get personal information stored in your email).
Megan, Los Angeles (Sent Jun 2, 2009 12:52:19 PM)
Another thing to be aware of is someone wanting to "friend" you but then is a scam asking for money. It is like the emails from banks in Nigeria. That happened to me. I quickly blocked the person from all contact. They said they were in Africa on business. Then a few days later, needed money to get home or finalize a business transaction or something. If they were there on business, why isn't the company paying for them to get home or for the business transaction?
Terri, Frankfort, KY (Sent Jun 2, 2009 12:50:04 PM)
"I think it is important for people to know if Mac users are just as vulnerable to phishing as PC users."
-----
Loren, phishing is completely independent of platform. Phishing is an attempt to trick you into divulging personal information, like passwords, credit card numbers, or social security numbers. It has absolutely nothing to do with what kind of computer you use.
Ray B., NYC (Sent Jun 2, 2009 12:45:14 PM)
I do not have any social network site accounts and this article just reinforces my desire never to sign up for any of these. My wife uses FB. I'll have her read this so she keeps her account and e-mail safe...
bd5, cali (Sent Jun 2, 2009 12:36:03 PM)
This possibly may help, but Mozilla Firefox has an add-on called "Web of Trust" or "WOT". Once installed, this add-on goes to work.
ANY link on your computer's screen while at a web page will have a "ring" next to it. The ring is either green (good) yellow (use caution) orange (beware!) or red (dangerous!) If you click on a red ring, for example, you get a warning and the option to "continue to the page" despite the warning, or "exit" the page in question.
I find this add-on very helpful when it comes to safe-surfing.
Glenn Hughes, San Francisco, CA (Sent Jun 2, 2009 12:04:38 PM)
I agree with the above posters. I don't click the links from the FB notifications -- I log into my profile to read them. I don't complete any surveys, or join mafia wars, or subscribe to different apps or groups. When I read the fine print about how it will track something on me and my friends, I very quickly hit cancel. The cyber world is very dangerous and you have to be extremely careful.
Michele P., Oklahoma City, OK (Sent Jun 2, 2009 11:47:58 AM)
I had exactly the same experience as Rachael from Huntsville (only it was my son-in-law who reloaded everything for me.) I suspected FB, but wasn't sure - until now. I have, however, been MUCH more careful since.
PGJ, Kansas City, Mo (Sent Jun 2, 2009 11:44:44 AM)
Many of these 3rd party apps are scary, from the point that you get the warning screen "allowing" permission to access your data on any social networking page. They should develop some "trusted" source, such as they do with downloads of free software. The website hosting the downloads provides a guarantee of security.
Thomas Sebnastiani, San Diego, CA (Sent Jun 2, 2009 11:26:12 AM)
Allie...I do the same thing, except that I don't have emails sent to my email account period, for anything regarding FB. I also found the people that I wanted to keep in touch with and then promptly blocked anyone from searching me. There are FB securities that people choose not to do, because they want 500+ friends. Everything I put on my account is for "friends only", even though I understand that once the pictures are up they are owned by FB. It's sad that the internet has become such a breeding ground for hackers and theives.
Thea, Jackson, WY (Sent Jun 2, 2009 11:15:02 AM)
I think it is important for people to know if Mac users are just as vulnerable to phishing as PC users. I am new to the Mac world and have been pleased with the success of my computer against attacks, yet I am clueless when it comes to phishing safety on a Mac vs. PC. Enlighten me please. I hope I am not the only one.
Loren, Muscatine, IA (Sent Jun 2, 2009 11:12:37 AM)
I don't believe I clicked a link in an email, but I did have a lot of applications via Facebook that I participated in. I got a horrible virus, telling me I had a virus on my computer and needed to pay to download a full version virus blocker. It was impossible to remove. It destroyed my restore drive, so I couldn't even restore to factory options. Luckily, my husband is an IT Network Engineer and was able to fix my computer by reloading EVERYTHING on it. I have changed my options to NEVER receive emails from FB and I've removed myself from all fan groups, removed all applications from my profile, and have gone back to FB to simply communicate with friends. No more quizzes, no more funny application. FB owners need to tighten the belt because this is going to ruin a LOT of people that know better, but have been suckered into trusting FB like I did --- unfortunately!
Rachael, Huntsville, AL (Sent Jun 2, 2009 11:01:33 AM)
Agreed, I too don't install any facebook apps for this very reason - no one but me needs access to my personal information.
Katie (Sent Jun 2, 2009 11:00:28 AM)
I really like being able to keep in touch with family I have quit using facebook. All the little things they want you to join will cost you. Boy did I find this out the hard way. After charges to the cell phone and the house phone in the hundreds of dollars I canceled my account and now I keeping getting emails to come back. No way will I go back. Facebook needs to be up front and state that there are charges for these things. DO NOT TAKE ANY QUIZS they are the worst and do not join any groups. As always just my opinion.
FTT Longmont, CO (Sent Jun 2, 2009 10:54:52 AM)
How do you know it hasn't gotten worse. Most financial institutions don't announce the phishing losses. I work for a financial institution and it is at a worse case scenario. We have elder members and they have no idea how that download by their nieces and nephews got into their online accounts and had funds disbursed to fraudulent payees. We now perform telephone confirmations on every online payment over $1,000 that doesn't fit a pattern. This is getting costly. These multi-billionaires need to get sued very soon in order to protect their clients. Currently it is the financial institutions taking the hits and it will soon be changing.
john doe (Sent Jun 2, 2009 10:46:06 AM)
My friends (especially those in real life) don't "get" why I won't install every little Facebook app, join every little group, and so on. This is why. I prefer to vet something before I join, install, or click.
Julie, Texas (Sent Jun 2, 2009 10:31:31 AM)
Just last week, I got a message from an ex-boyfriend from college days saying that he’d gone to London for a seminar and needed $2,500 to be wired to him because his wallet had been stolen. The message came from his email account (he’s had this account for years) and seemed very real since it contained pertinent and relevant information about him, e.g. his profession requires him to present at these types of seminars. Knowing him the way I do, the email seemed out of character. He would never ask me for money and the salutation was generic…”Hello My Friend”. I immediately called him and he said that I was the 7th or 8th person to call him that morning about that same email.
Long story short…he had just come onto Facebook a week or two prior and he believes the person gained access to his info from his Facebook account.
jshipleyj, Miami, FL (Sent Jun 2, 2009 10:17:38 AM)
It's amazing, people are so worried about "big brother" watching them, yet they post pictures and personal details on sites like facebook.
Irony.
Richie I, Pequannock, NJ (Sent Jun 2, 2009 10:10:47 AM)
I have been fighting the stupid facebook virus for the last week, as apparently smart employees clicked on links willy nilly. When will people learn to not trust everything that comes to them?
iamltr (Sent Jun 2, 2009 9:33:56 AM)
Facebook is bad as they continuly send all these stupid survey's and each one you do if you know it or not gives them more and more information about you, then in constantantly tries to get their friends to do the same,all this info gives them info of what type of ad emails they start to bombard you with, any information you give out anywhere on the web, can be used against you later on, So quit answering all them surveys.
ange (Sent Jun 2, 2009 9:18:19 AM)
Interesting article. I have my FB set up so that all email notifications go to my junk email and I never even seem them, much less click on them. I only access FB by logging in.
And I am one of those who limits my FB friends, although other friends have failed to understand this. When I get a friend request from someone who is a friend of a friend or someone I never knew very well, I just deny them! My purpose in signing up was to get back in touch with old college friends and cousins that had moved all over the world, and I won't let someone else try to dictate what my FB should be -- I don't need 800 "friends"!
Allie, Columbia, SC (Sent Jun 2, 2009 9:12:58 AM)
SEND A COMMENT
PLEASE READ: All comments must be approved before appearing in the thread; time and space constraints prevent all comments from appearing. We will only approve comments that are directly related to the blog, use appropriate language and are not attacking the comments of others. Firms mentioned in our comment area are welcome to add their own comments.