Live Well, Work Well, Love Life » Facebook

Facebook’s Security Mess

ssh — Wed, 18 Aug 2010 16:04:36 +0000

Last week I was sitting in my office working away on a client’s iPhone app when my iPhone’s text message bell alert rang. I picked up my phone to see my daughter’s text message: “Free iPad event?” After an exchange, I learned that my Facebook account had sent her an event request with a link to a rogue quiz site that was offering quizzes for the amazingly low price of $19.99 a month. I also started getting emails from other friends who were getting the invitation from me.

So, I got mad.

First, I deleted the event. Then, I posted to my wall about it. And then, I went on the warpath.

You see, I am very careful about my Facebook account. While I explore aspects of Facebook as part of my research for clients, I am aware of the dangers and am diligent in working through the possible issues. But, I got caught. So, I went looking for the source of the issue.

The first thing I learned is that I am not alone. There is even a Facebook group that has grown up to oppose it. But, no one seemed to know how it was done, so I began to investigate.

Given the invitation text and the targets, I figured out that it had to have come from an application with access to my account. I dug through my entire list of applications, eliminating many that were either old or that I don’t use. But, it’s important to understand that Facebook makes this process far more painful than it needs to be. If only Facebook would make a note on the wall posts, event invites, and other items noting what application was used to create it, we could track down the reprobates who build these cheap cheats. Twitter even does it:

Twitter displays the source of the Tweet below the text

So Twitter, with its informal nature, trumps Facebook in one of the most important aspects of security: transparency.

In my next few posts, I’ll outline what you can do to scrub your Facebook account in a way that will make it much more hardened against this kind of attack. However, with the limited transparency of Facebook’s system right now, there is only so much you can do.

Being Careful Isn’t Enough

ssh — Tue, 10 Aug 2010 23:30:24 +0000

“Want a free iPad?” That’s an email that my Facebook friends received from me this morning. The problem is, I never sent it. In fact, I never saw it until it had been sent on my behalf. Being careful isn’t enough.

I wrote here on this very blog last year about the various trojans and other attacks made on and through Facebook.

Today, I was used.

This morning as I was starting work, my daughter sent a text message asking me about a free iPad. I didn’t know what she was talking about. Then, after a bit of investigation, I learned that some rogue application that I had approved for access to my Facebook account, had sent an event invitation to everyone on my Friends list.

This is a big deal.

It’s a big deal because I cannot even easily send a message to everyone on my friends list. Therefore, my apology email took a while to create, since I had to manually create a list with all of my friends on it.

It’s also a big deal because there was no way for me to find out from the invitations which application sent it. Was one of the seemly appropriate applications like Twitter or Foursquare the issue? Or how about that Fast Company Influence Project app that I set up yesterday? I can’t tell. The invitation does tell anyone how it was created, and I have no way of working backwards from the invitation to the app and removing its permissions.

This is a Facebook security problem, and Facebook needs to address it. As a result of this issue, I have removed a number of apps from my Facebook page and will remove all of them if it happens again.

In the meantime, I’m committed to doing what I can to track down this rogue app. If you have any insight into how this was done or what app might have done it, I’d love to get your insights. I’ll update this post as I discover more.

Kill Flash, Fix Your System

ssh — Wed, 04 Aug 2010 20:05:39 +0000

A Facebook conversation this week reminded me that many people do not know how damaging Adobe Flash can be on many systems, especially, it seems, those running Apple’s OS X. For many years, I have found Flash more annoying than anything, and so have run various plug-ins to keep Flash from loading in my browsers. There are also an additional mini-application that you may find useful.

First, there are a number of Flash blocking plug-ins for the various browsers available. For Firefox, there’s FlashBlock. Ffor Safari there’s ClickToFlash. For Google Chrome, there’s Kill-Flash. All of these plugins do the same thing: they replace the Flash elements on a page with a clickable image. If you don’t click, no Flash ever loads. If you do, Flash loads and plays.

One think I especially like about ClickToFlash is that you can adjust the settings to load H.264 videos on YouTube instead of Flash when it is available. Very nice.

In addition to these plug-ins, I also use BashFlash on my Macs. This little application sits quietly in the menubar until one of the Flash processes starts going crazy. Sometimes, a Flash process can cycle up and take over a computer. When one does this, BashFlash wakes up, turns red, and lets you kill the runaway Flash process.

Together, these plugins and app will make your browsing experience much more pleasant. I run ClickToFlash and Kill-Flash on my two most-used browsers, and keep BashFlash on hand, too. Let me know how it goes for you.

More Facebook Phishing

ssh — Sat, 23 May 2009 15:13:10 +0000

The word “Phishing” is used for sites that steal your identity, and there are more Phishing sites stealing Facebook login information today.

First thing this morning, I received a Facebook message with the subject “Hi” and the content “Look at redbuddy dot be”. Going to that site gets you the same kind of site as I reported in Facebook Trojan Attack earlier this week. Once again it’s obviously a phishing site, with language like, ”We helps you connect and share with the people in your life.” and yet people are still being sucked in!

Beware! Do not log in to any site that you don’t absolutely know is the site you want. Realize that any time you use your login, it can be compromised. I’m putting together a brief video on this that I plan to have ready this weekend.

For more insights on social media, check out my social media programs.

Facebook Trojan Attack

ssh — Thu, 21 May 2009 18:47:56 +0000

This morning, I received a facebook message that was short and questionable: “Check kirgo.at.” Interested, I visited the site, only to discover a poorly-disguised site attempting to look like a Facebook login page:

Fake Facebook Page

While this page doesn’t look very much like the real Facebook login page, and all of the links at the bottom go nowhere, some people are being caught by this trojan. They enter their Facebook credentials and their accounts are immediately compromised. Once compromised, their account sends a Facebook message to everyone in their Friends list with the same message (“Check X.at.”). That’s how the Trojan propogates.

Note that some people got this message in their email (because Facebook sends them a copy of their messages) and jumped to the page from there.

Here is the rule: Do not EVER give your Facebook credentials to any site other than Facebook, and do not follow a link to something that looks like Facebook and fill in your credentials. Period.

Update: Late today, Facebook added some additional controls to their login page in an effort to defeat the hackers, checking login attempts against the location from which the attempt is coming. This is a good move start for Facebook, who are still so new at the game that there are a number of security holes in their systems.

If you read HTML, the following is the complete HTML from the page as of 11:40am MDT on May 21, 2009:




	
	Login
	
    
    
    
    




	
		
			
				
				
			
			
				Sign Up
					
						
					
				
				We helps you connect and share with the people in your life.
 
 
 
 

				Login
				
				
				Email:
				Password:
				Remember me
				
				
Forgot your password?


© 2009
Login
About
Advertising
Careers
Terms
Privacy
Mobile
Help

This is not the only domain name that is attempting this, either, so beware!