Security experts are warning Web-surfing consumers about a rise in cybercrime and scams related to Osama bin Laden's death.
Major news events are often accompanied by an uptick in cybercrime, as perpetrators seek to take advantage of Web searches for content such as pictures and videos.
"I suppose this was just inevitable," Dave Marcus, director of security research for McAfee Labs, wrote in a blog post. "The reported death of Osama Bin Laden is just too good a lure for cybercriminals and scammers to pass up."
Marcus said e-mails are circulating with links purporting to lead to photos of bin Laden's corpse. One message teases to a video showing bin Laden disproving his death by holding a newspaper with Monday's date. Clicking on the links generally opens files that install malware on the user's computer. In other cases, cybercriminals have poisoned Google Images results.
Facebook is also a fertile breeding ground for these scams, with malicious links being circulated on posts and messages within the social networking site. Researchers at Kaspersky Labs said they noticed scam ads on Facebook promising free merchandise in celebration of bin Laden's death. Users that click on the ads will be redirected multiple times, with each layer asking for more detailed personal information, Kaspersky Labs said.
Experts at Websense said cybercriminals compromised the website of Sohaib Athar, the Pakistani information technology consultant living in Abbottabad who provided a real-time account of the U.S. operation via his Twitter feed. In a blog post, Websense said a malicious code was embedded into the site that installs malware on a computer. The malware installs fake software that looks like a security tool, and prompts users to enter their credit card information to purchase a premium version of this software.
Security experts said consumers should be careful searching for information on the Web, visiting only websites of credible news sources, and be wary of links in e-mails. Making sure anti-virus and firewall software is updated is also helpful, as these kinds of attacks are increasingly common.
"We believe the hackers laid the criminal groundwork in advance, waiting for the right news trigger," said Rony Moshkovich, malware researcher at PC Tools.
Source: http://www.chicagobreakingnews.com/news/local/chibrkbus-bin-ladens-death-leads-to-surge-in-cybercrimes-internet-scams-20110503,0,101828.story
Showing posts with label Identity 'at risk' on Facebook. Show all posts
Showing posts with label Identity 'at risk' on Facebook. Show all posts
Tuesday, May 3, 2011
Thursday, January 27, 2011
Facebook to let advertisers republish user posts
Facebook to let advertisers republish users' check-ins as 'sponsored stories'
NEW YORK (AP) -- Facebook users who check in to a store or click the "like" button for a brand may soon find those actions retransmitted on their friends' pages as a "Sponsored Story" paid for by advertisers.
Currently there is no way for users to decline this feature.
Facebook says this lets advertisers promote word-of-mouth recommendations that people already made on the site. They play up things people do on the site that might get lost in the mass of links, photos, status updates and other content users share on the world's largest social network.
The new, promoted posts would keep the same privacy setting that the original posting had. So if you limit your check-ins to a specific group of friends, only these same friends would see the "Sponsored Story" version later.
The promoted content will appear on the right side of users' home pages, not in their main news feed. That's where regular ads, friend requests and other content are located.
Involving users in advertisements without their consent has been a thorny issue for Facebook. Marc Rotenberg, executive director of the Electronic Privacy Information Center, said in this case the company is making money off a person's name or likeness without their consent. He calls it "subtle and misleading" and says users should object.
Twitter already offers advertisers something similar, called "promoted tweets." These are Twitter posts paid for by advertisers to show up in search results and on top of popular topic lists on the site. But while Twitter's ads are written by the companies that pay for them, Facebook's sponsored stories are created by users.
Both represent an effort to make advertisements more akin to what people are already experiencing on the site instead of putting up virtual billboards that users might ignore or find tacky.
Online Video from Facebook: http://www.facebook.com/video/video.php?v10100328087082670
Source: http://finance.yahoo.com/news/Facebook-to-let-advertisers-apf-1912961417.html?x=0
NEW YORK (AP) -- Facebook users who check in to a store or click the "like" button for a brand may soon find those actions retransmitted on their friends' pages as a "Sponsored Story" paid for by advertisers.
Currently there is no way for users to decline this feature.
Facebook says this lets advertisers promote word-of-mouth recommendations that people already made on the site. They play up things people do on the site that might get lost in the mass of links, photos, status updates and other content users share on the world's largest social network.
The new, promoted posts would keep the same privacy setting that the original posting had. So if you limit your check-ins to a specific group of friends, only these same friends would see the "Sponsored Story" version later.
The promoted content will appear on the right side of users' home pages, not in their main news feed. That's where regular ads, friend requests and other content are located.
Involving users in advertisements without their consent has been a thorny issue for Facebook. Marc Rotenberg, executive director of the Electronic Privacy Information Center, said in this case the company is making money off a person's name or likeness without their consent. He calls it "subtle and misleading" and says users should object.
Twitter already offers advertisers something similar, called "promoted tweets." These are Twitter posts paid for by advertisers to show up in search results and on top of popular topic lists on the site. But while Twitter's ads are written by the companies that pay for them, Facebook's sponsored stories are created by users.
Both represent an effort to make advertisements more akin to what people are already experiencing on the site instead of putting up virtual billboards that users might ignore or find tacky.
Online Video from Facebook: http://www.facebook.com/video/video.php?v10100328087082670
Source: http://finance.yahoo.com/news/Facebook-to-let-advertisers-apf-1912961417.html?x=0
Saturday, January 16, 2010
Network flaw causes scary Web error
Alarming network glitch makes the Internet lose track of who is who on Facebook
SAN FRANCISCO (AP) -- A Georgia mother and her two daughters logged onto Facebook from mobile phones last weekend and wound up in a startling place: strangers' accounts with full access to troves of private information.
The glitch -- the result of a routing problem at the family's wireless carrier, AT&T -- revealed a little known security flaw with far reaching implications for everyone on the Internet, not just Facebook users.
In each case, the Internet lost track of who was who, putting the women into the wrong accounts. It doesn't appear the users could have done anything to stop it. The problem adds a dimension to researchers' warnings that there are many ways online information -- from mundane data to dark secrets -- can go awry.
Several security experts said they had not heard of a case like this, in which the wrong person was shown a Web page whose user name and password had been entered by someone else. It's not clear whether such episodes are rare or simply not reported. But experts said such flaws could occur on e-mail services, for instance, and that something similar could happen on a PC, not just a phone.
"The fact that it did happen is proof that it could potentially happen again and with something a lot more important than Facebook," said Nathan Hamiel, founder of the Hexagon Security Group, a research organization.
Candace Sawyer, 26, says she immediately suspected something was wrong when she tried to visit her Facebook page Saturday morning.
After typing Facebook.com into her Nokia smart phone, she was taken into the site without being asked for her user name or password. She was in an account that didn't look like hers. She had fewer friend requests than she remembered. Then she found a picture of the page's owner.
"He's white -- I'm not," she said with a laugh.
Sawyer logged off and asked her sister, Mari, 31, her partner in a dessert catering company, and their mother, Fran, 57, to see whether they had the same problem on their phones.
Mari landed inside another woman's page.
Fran's phone -- which had never been used to access Facebook before -- took her inside yet another stranger's page, one belonging to a young woman from Indiana. They sent an e-mail to one of their own accounts to prove it.
They were dumbfounded.
"I thought it was the phone -- `Maybe this phone is just weird and does magical, horrible things and I have to get rid of it,'" said Candace Sawyer.
The women, who live together in East Point, Ga., outside Atlanta, had recently upgraded to the same model of phone and all used the same carrier, AT&T.
Sawyer contacted The Associated Press after reporting the problem to Facebook and AT&T.
The problem wasn't in the phones. It was a flaw in the infrastructure connecting the phones to the Internet.
That illuminates a grave problem.
Generally Web sites and computers are compromised from within. A hacker can get a Web page or computers to run programming code that they shouldn't. But in this case, it was a security gap between the phone and the Web site that exposed strangers' Facebook pages to the Sawyers. Misconfigured equipment, poorly written network software or other technical errors could have caused AT&T to fumble the information flowing from the Sawyers' phones to Facebook and back.
Fortunately, Hamiel said, the vulnerability would be of limited use to a hacker interested in pulling off widespread mayhem, because this hole would let him access only one account at a time. To do more damage the criminal would have to pull off the unlikely feat of gaining full control of the piece of equipment that routes Internet traffic to individual users.
AT&T spokesman Michael Coe said its wireless customers have landed in the wrong Facebook pages in "a limited number of instances" and that a network problem behind those episodes is being fixed.
The Sawyers experienced a different glitch. Coe said an investigation points to a "misdirected cookie." A cookie is a file some Web sites place on computers to store identifying information -- including the user name that Facebook members would enter to access their pages. Coe said technicians couldn't figure out how the cookie had been routed to the wrong phone, leading it into the wrong Facebook account.
He also said AT&T could confirm only that the problem occurred on one of the Sawyers' phones, possibly because they had logged off Facebook on the other two before reporting the incident.
Facebook declined to comment and referred questions to AT&T.
Some Web sites would be immune from this kind of mix-up, particularly those that use encryption. A Web browser would have trouble deciphering the encryption on a page that a computer user didn't actually seek, said Chris Wysopal, co-founder of Veracode Inc., a security company.
Sensitive sites and those used for banking and e-commerce generally use encryption. But most other sites, including some Web-based e-mail services, don't use it. One way of checking: The Web addresses of encrypted sites begin with "https" rather than "http." Facebook uses encryption when user names and passwords are entered, to cloak the sign-on from snoops, but after the credentials are entered the encryption is dropped.
It's unclear how many people were affected by the problem the Sawyers discovered, and whether it was limited to Facebook.
The reason all three women experienced the glitch is a function of the way cellular networks are designed. In some cases, all the mobile Internet traffic for a particular area is routed through the same piece of networking equipment. If that piece of equipment is misbehaving or set up incorrectly, strange things happen when computers down the line receive the data.
Usually that means a Web site simply won't load, said Alberto Solino, director of security consulting services for Core Security Technologies. In the Sawyers' case, "somehow they got the wrong user but they could keep using that account for a long period of time. That's what's strange," he said.
The AP tried to contact two of the people whose Facebook pages were exposed to the Sawyers, but the calls and e-mails were not returned. It's unclear whether they are also AT&T customers, though security experts said that's likely the case.
Indeed, it was the case in a similar incident in November.
Stephen Simburg, 25, who works in marketing, was home for Thanksgiving in Vancouver, Wash., when he logged onto Facebook from his cell phone. He didn't recognize the people who had written him messages.
"I thought I had gotten really popular all of a sudden, or something was wrong," he said. Then he saw the picture of the account owner: A young woman.
He got her e-mail address from the site, logged off and wrote the woman a message. He asked whether he had met her at some point and she had borrowed his phone to check her Facebook account.
"No," she wrote back, "but I was just telling my family that I ended up in your profile!"
Simburg and the woman figured out they were both using AT&T to access Facebook on their phones. (AT&T had no comment because the incident wasn't reported to the company.)
"I felt like I had been let down by the phone company and by Facebook," he said.
He says he has put the incident behind him. But one piece of it remains: He and the young woman are now Facebook friends.
Source: http://finance.yahoo.com/news/AP-Exclusive-Network-flaw-apf-3043392874.html?x=0
SAN FRANCISCO (AP) -- A Georgia mother and her two daughters logged onto Facebook from mobile phones last weekend and wound up in a startling place: strangers' accounts with full access to troves of private information.
The glitch -- the result of a routing problem at the family's wireless carrier, AT&T -- revealed a little known security flaw with far reaching implications for everyone on the Internet, not just Facebook users.
In each case, the Internet lost track of who was who, putting the women into the wrong accounts. It doesn't appear the users could have done anything to stop it. The problem adds a dimension to researchers' warnings that there are many ways online information -- from mundane data to dark secrets -- can go awry.
Several security experts said they had not heard of a case like this, in which the wrong person was shown a Web page whose user name and password had been entered by someone else. It's not clear whether such episodes are rare or simply not reported. But experts said such flaws could occur on e-mail services, for instance, and that something similar could happen on a PC, not just a phone.
"The fact that it did happen is proof that it could potentially happen again and with something a lot more important than Facebook," said Nathan Hamiel, founder of the Hexagon Security Group, a research organization.
Candace Sawyer, 26, says she immediately suspected something was wrong when she tried to visit her Facebook page Saturday morning.
After typing Facebook.com into her Nokia smart phone, she was taken into the site without being asked for her user name or password. She was in an account that didn't look like hers. She had fewer friend requests than she remembered. Then she found a picture of the page's owner.
"He's white -- I'm not," she said with a laugh.
Sawyer logged off and asked her sister, Mari, 31, her partner in a dessert catering company, and their mother, Fran, 57, to see whether they had the same problem on their phones.
Mari landed inside another woman's page.
Fran's phone -- which had never been used to access Facebook before -- took her inside yet another stranger's page, one belonging to a young woman from Indiana. They sent an e-mail to one of their own accounts to prove it.
They were dumbfounded.
"I thought it was the phone -- `Maybe this phone is just weird and does magical, horrible things and I have to get rid of it,'" said Candace Sawyer.
The women, who live together in East Point, Ga., outside Atlanta, had recently upgraded to the same model of phone and all used the same carrier, AT&T.
Sawyer contacted The Associated Press after reporting the problem to Facebook and AT&T.
The problem wasn't in the phones. It was a flaw in the infrastructure connecting the phones to the Internet.
That illuminates a grave problem.
Generally Web sites and computers are compromised from within. A hacker can get a Web page or computers to run programming code that they shouldn't. But in this case, it was a security gap between the phone and the Web site that exposed strangers' Facebook pages to the Sawyers. Misconfigured equipment, poorly written network software or other technical errors could have caused AT&T to fumble the information flowing from the Sawyers' phones to Facebook and back.
Fortunately, Hamiel said, the vulnerability would be of limited use to a hacker interested in pulling off widespread mayhem, because this hole would let him access only one account at a time. To do more damage the criminal would have to pull off the unlikely feat of gaining full control of the piece of equipment that routes Internet traffic to individual users.
AT&T spokesman Michael Coe said its wireless customers have landed in the wrong Facebook pages in "a limited number of instances" and that a network problem behind those episodes is being fixed.
The Sawyers experienced a different glitch. Coe said an investigation points to a "misdirected cookie." A cookie is a file some Web sites place on computers to store identifying information -- including the user name that Facebook members would enter to access their pages. Coe said technicians couldn't figure out how the cookie had been routed to the wrong phone, leading it into the wrong Facebook account.
He also said AT&T could confirm only that the problem occurred on one of the Sawyers' phones, possibly because they had logged off Facebook on the other two before reporting the incident.
Facebook declined to comment and referred questions to AT&T.
Some Web sites would be immune from this kind of mix-up, particularly those that use encryption. A Web browser would have trouble deciphering the encryption on a page that a computer user didn't actually seek, said Chris Wysopal, co-founder of Veracode Inc., a security company.
Sensitive sites and those used for banking and e-commerce generally use encryption. But most other sites, including some Web-based e-mail services, don't use it. One way of checking: The Web addresses of encrypted sites begin with "https" rather than "http." Facebook uses encryption when user names and passwords are entered, to cloak the sign-on from snoops, but after the credentials are entered the encryption is dropped.
It's unclear how many people were affected by the problem the Sawyers discovered, and whether it was limited to Facebook.
The reason all three women experienced the glitch is a function of the way cellular networks are designed. In some cases, all the mobile Internet traffic for a particular area is routed through the same piece of networking equipment. If that piece of equipment is misbehaving or set up incorrectly, strange things happen when computers down the line receive the data.
Usually that means a Web site simply won't load, said Alberto Solino, director of security consulting services for Core Security Technologies. In the Sawyers' case, "somehow they got the wrong user but they could keep using that account for a long period of time. That's what's strange," he said.
The AP tried to contact two of the people whose Facebook pages were exposed to the Sawyers, but the calls and e-mails were not returned. It's unclear whether they are also AT&T customers, though security experts said that's likely the case.
Indeed, it was the case in a similar incident in November.
Stephen Simburg, 25, who works in marketing, was home for Thanksgiving in Vancouver, Wash., when he logged onto Facebook from his cell phone. He didn't recognize the people who had written him messages.
"I thought I had gotten really popular all of a sudden, or something was wrong," he said. Then he saw the picture of the account owner: A young woman.
He got her e-mail address from the site, logged off and wrote the woman a message. He asked whether he had met her at some point and she had borrowed his phone to check her Facebook account.
"No," she wrote back, "but I was just telling my family that I ended up in your profile!"
Simburg and the woman figured out they were both using AT&T to access Facebook on their phones. (AT&T had no comment because the incident wasn't reported to the company.)
"I felt like I had been let down by the phone company and by Facebook," he said.
He says he has put the incident behind him. But one piece of it remains: He and the young woman are now Facebook friends.
Source: http://finance.yahoo.com/news/AP-Exclusive-Network-flaw-apf-3043392874.html?x=0
Wednesday, April 30, 2008
Identity 'at risk' on Facebook
Personal details of Facebook users could potentially be stolen, the BBC technology programme Click has found.
The popular social networking site, allows users to add a variety of applications to their profile.
But a malicious program, masquerading as a harmless application, could potentially harvest personal data.
Facebook says users should exercise caution when adding applications. Any programs which violate their terms will be removed, the network said.
Stealing details
Facebook is the darling of the moment, allowing friends to stay in touch, post photos, and share fun little games and quizzes. And it also lets you keep your details private from the rest of the world. Or at least that is the implication.
We have discovered a way to steal the personal details of you and all your Facebook friends without you knowing.
We made up the fictitious profile of Bob Smith. He keeps most of his details on his profile private from non-friends.
While we could not get all details, what we did get, included his name, hometown, school, interests and photograph, would certainly help us to steal someone's identity.
Mining data
So how did we do it?
Using a couple of laptops and our resident coder Pete, we created a special application for Facebookers to add.
One of the reasons Facebook has become so popular so quickly is because of the wealth of applications users can add to their profile pages.
Little games, quizzes, IQ tests, there are thousands of them available. And once you have added an application, your friends are encouraged to add it too.
Anyone with a basic understanding of web programming can write an application.
We wrote an evil data mining application called Miner, which, if we wanted, could masquerade as a game, a test, or a joke of the day. It took us less than three hours.
But whatever it looks like, in the background, it is collecting personal details, and those of the users' friends, and e-mailing them out of Facebook, to our inbox.
When you add an application, unless you say otherwise, it is given access to most of the information in your profile. That includes information you have on your friends even if they think they have tight security settings.
Did you know that you were responsible for other people's security?
Security
Now, many applications do need access to your details, in order to work properly.
We do not know of any specific application which abuses user information, apart from ours.
But the ease with we created our application has many people worried. If it is being used you would not even have to use the application we created to become a victim, you would just have to be a friend of someone who has.
Because these applications run on third-party servers, not run by Facebook - it is difficult for the company to check what is going on, whether anything has changed, and how long applications store data for and what they do with it.
Although Facebook's terms and conditions contain a warning that this could in theory happen, and offer the option to stop an application from accessing your details, many games and quizzes would not work if this option is engaged.
In fact, the only way we can see of completely protecting yourself from applications skimming information about you and your friends is to erase all the applications on your profile and opt to not use any applications in the future.
So has Facebook done enough to protect its users from identity theft?
Paul Docherty is the Technical Director of Portcullis Security, which advises several governments on IT security matters including British government.
He told us he believed that Facebook's terms and conditions stated on the site meant that Facebook had legally covered itself from any liability.
But he added: "Morally, Facebook has acted naively."
He said: "Facebook needs to change its default settings and tighten up security."
He also believes it would be difficult to secure the current system because so many third party applications are now in circulation.
Removal team
We put these concerns to Facebook.
It told us that it has an entire investigations team watching the site, and removing applications that violate its terms of use which would include our Miner application.
It also advises users to use the same precautions while downloading software from Facebook applications that they use when downloading software on their desktop.
Now, all this comes in the month that competitor MySpace opened up its application platform. However, it handles them differently - here all applications run on its own servers so it can see what they are up to.
MySpace also manually checks all submissions and rechecks them if authors wish to change the code. We were unable to create a similar threat to users' security using the MySpace system.
It certainly seems that Facebook's standard security settings are not sufficient to protect your personal information, and those of your friends.
Source: http://news.bbc.co.uk/2/hi/programmes/click_online/7375772.stm
Subscribe to:
Posts (Atom)
