Activists hijack Facebook groups 'to expose holes'
SAN FRANCISCO (AFP) - – Activists claimed to have seized control of nearly 300 Facebook community groups in a self-proclaimed effort to expose how vulnerable online reputations are to tampering.
A group called "Control Your Info" (CYI) claimed credit for commandeering 289 Facebook groups, saying it was simple to get into poorly-protected administrative settings at the website.
"This is just one example that really shows the vulnerabilities of social media," said a blog post at controlyour.info.
"If you chose to express yourself on the Internet, make sure the expressions are your own and not a spammers. This isn't some kind of scare tactic, nor is it a hack, it's a feature that can be used, and is being used, in bad ways."
CYI claimed its motives were pure and that the move was more of a "take-over" than a computer hack of Facebook groups.
Facebook Groups are themed chat venues that users of the social networking service can join to socialize online with people who share interests.
"Facebook Groups suffer from a major flaw," said a message on the CYI blog.
"If an administrator of a group leaves, anyone can register as a new admin. So, in order to take control of a Facebook group, all you really have to do is a quick search on Google."
Once CYI accessed groups as administrators it had authority to change anything, including pictures, descriptions and settings.
CYI fired off messages to the groups telling them they had been "hijacked" and the justification for the attacks. CYI rechristened each group with its name and logo.
CYI promised to restore the violated groups to their original conditions after it makes its point.
"Our main goal is to draw attention to questions concerning online privacy awareness," CYI said. "People have even lost their jobs over Facebook content. We wanted to do something about this."
Facebook said there was no hacking involved and there was no confidential information at risk.
The groups targeted had been abandoned by their owners, which left doors open for group members to make themselves administrators.
"Group administrators have no access to private user information and group members can leave a group at any time," Facebook said.
"In the rare instances when we find that a group has been changed inappropriately, we will disable the group, which is the action we plan for these groups."
Beware Facebook 'Friends' Who Trash Your Laptop
The message that popped into Laurie Gale's Facebook inbox last month seemed harmless enough — a friend had seen a video of her and had sent a link so she could view it.
January 30, 2009
The link led to a video site that prompted her to update her video software, which she did.
"Within seconds, everything started shutting itself down," says Gale, a 37-year-old lamp-works artist from Versailles, Ky.
Gale's new Dell Inspiron laptop had been infected with malicious software, or malware, that has spread through social networking sites like Facebook and MySpace.
"I cried for an hour," Gale says. It took a trip to the local computer repair shop and several phone calls with Dell customer-service representatives for her to restore the computer to its factory settings. "It was three days of torture."
The popularity of social networks and social media sites has grabbed the attention of cyber crooks searching to pilfer passwords, called "phishing," and steal sensitive personal information.
The hackers are exploiting users' sense of safety within these sites, says Pat Clawson, chief executive of Lumension Security, a computer security company.
Earlier this month, Twitter, a social site in which users communicate in short bursts of text, was hit in a campaign to steal users' account passwords. On business-networking site LinkedIn, criminals set up fake celebrity profiles that, when visited, downloaded malware onto users' machines.
The Downside of Friends: Facebook's Hacking Problem
By Claire SuddathTuesday, May. 05, 2009
You get a quick message from a friend on Facebook, click on the link and absentmindedly log in to a website pretending to be Facebook. This is what happened last week, when scammers unleashed a new attack on Facebook, collecting users' log-in information and passwords and pilfering victims' "friends" lists to target the next dopes. Listen up, people: Although Facebook has a reputation for Internet security — it identified the scam within hours, and the ripple effects only lasted for a couple days — at 200 million members and counting, the size and popularity of the social-networking site has made it the object of increasing attention from hackers and spammers. And if last week is any indication, it's only going to get worse.
"In the '90s, scammers used e-mail," says Michael Argast, a security analyst at Sophos, an antivirus software company. "Today, it's social networking." Argast explains that although people have been trained not to click on suspicious e-mails, they don't operate with the same sense of caution when presented with a link on Facebook or Twitter. Maybe that's why the number of phishing attacks on these kinds of sites — in which people are fishing for account information, as opposed to infecting your computer with a virus — has skyrocketed recently, from 4,600 attacks in 2007 to 11,000 in 2008. This year doesn't look any better, with 6,400 attacks in the first three months of 2009.
Like anything on the Internet, Facebook has never been completely scam-free, but its privacy settings may create a false sense of security: most users can't interact with one another unless they are "friends" or belong to the same general network. The site at first glance would also seem less of a gold mine for swindlers since unlike financial websites, which offer access to victims' bank accounts, there is no direct financial gain from hacking into a Facebook account. But the bad guys know that many of us are lazy or forgetful and use the same password on multiple sites. In early 2008, Facebook noticed a marked increase in the number of scams. "We're the most effective distribution platform on the Internet," says Ryan McGeehan, the company's incidence-response manager. "The level of person-to-person connection doesn't exist anywhere else. And as we get bigger, we become a bigger target."
Facebook monitors users' activity, and when someone goes from a few wall posts a week to hundreds of messages within a few minutes, the security team can logically assume that the account has been hacked. They'll notify the user, reset the password, and the whole issue is usually resolved within a few hours. But when thousands of users are hacked at once — and then their friends are hacked, and their friends' friends are hacked — it can take a few days for Facebook to fix the problem. That's what happened on April 29 and 30, when users found themselves accidentally logging in to a website calledFBAction.net. Designed to look exactly like Facebook, the evil doppelgänger took their info and hacked their accounts.
When MarkMonitor, an outside security company employed by Facebook, shut down the fake website, the scam popped up again on a different site, FBStarter.com. (It too has since been disabled.) "My guess is this was a pretty organized group of people," says Fred Felman, MarkMonitor's chief marketing officer. Felman says the phishers, whoever they were (Internet scammers almost never get caught), were not using the most up-to-date technology, but their creativity and speed makes him think that they have experience and will probably do it again.
A similar phishing scam established a toehold on the website in January. And last year hackers broke into accounts by convincing people to click on links posted on their profile walls. Another common Facebook scam is to hack someone's account and then send messages to friends asking for money (like the old Nigerian businessman scam, but with a hey-it's-your-old-pal twist).
Facebook won't say how many accounts were compromised last week, but a rep notes that the site has never had a scammer hack more than a small fraction of its accounts, adding that the company's security team — which has more than 100 analysts, engineers and programmers — can handle whatever comes their way. "We're going to be attacked again in the future," says McGeehan, "and my role is to be prepared when it happens."
Cyber-criminals targeting social networks: experts
By Virginie Grognou - July 30, 2009
VALENCIA, Spain (AFP) - - Facebook, MySpace and other social networking sites are inceasingly being targeted by cyber-criminals drawn to the wealth of personal information supplied by users, experts warn.
Data posted on the sites -- name, date of birth, address, job details, email and phone numbers -- is a windfall for hackers, participants at Campus Party, one of the world's biggest gatherings of Internet enthusiasts, said.
A vicious virus Koobface -- "koob" being "book" in reverse -- has affected thousands Facebook and Twitter users since August 2008, said Asier Martinez, a security specialist at global IT solutions provider Panda Security.
"Its spread has been very significant and it has been detected in 4,000 different variants," he told AFP at the week-long event which wraps up Sunday in Valencia in eastern Spain.
The virus hijacks the accounts of social networking site users and sends messages steering friends to hostile sites coontaining malware, a malicious software often designed to infiltrate a computer system for illicit purposes.
In one of its variants, Koobface sends the victim a warning that its Flash player is outdated along with an invitation to download a new version, which is is in fact the virus.
Malware can be used to steal bank account data or credit card information once installed on a personal computer.
Facebook has sought to resist attacks by Koobface and similar viruses by blocking links to hostile sites and shutting down accounts from users that show signs of infection, such as sending too many messages.
"You also must be very careful with people who ask to join your friends list," said Laura Garcia, who writes a popular blog about Internet security, adding that hackers often send requests.
Another danger of social networking sites are the popular quizzes, horoscopes and games made available for free to users which can sometimes be used to hide links to hostile sites, she added.
Birthday greetings and as well as messages sent at Christmas and other holidays may also appear to come from friends when in fact they are linked directly to sites that try to convince would-be victims to reveal personal information like passwords or bank numbers, said Martinez.
The vulnerability of social networking sites was underscored in a study by security company Sophos made public earlier this month.
It found that about half of all companies in the United States block some or all access to them due to concerns about cyber incursions via the sites.
Facebook says that less than one percent of its users have been affected by a security issue, such as a virus, since the site opened in 2004.
Garcia said the number of viruses detected in recent years has exploded while the profile of cyber-criminals has changed.
"Before it was very savvy teenagers who wanted to show off their computer skills. Now you don't really need to know much about information technology to be a hacker, all the tools have already been created," she said.
Real cyber-crime mafias have now taken over, especially in Russia, China Brazil and the Ukraine whose goals are purely economic gain, she said, underscoring that hacking could be highly lucrative.
For an initial investment of $1,500 dollars (1,050 euros) for Mpack, a programme created to infect web pages, hackers can obtain a profit of between $21,000 and $847,000 dollars in just one month, Martinez said.
Around 6,000 people are expected to attend the Campus Party, which unites participants from all over the world to share ideas, experiences and all types of activities related to computers, communications and new technology.
The annual event began in Spain in 1997. Editions of the event have since been held in Brazil and Colombia.