'I totally owned your grandma' aka social networks as attack platforms

Guest editorial by Steve Manzuik

Lately there has been a lot of attention given to various privacy issues of social networking sites.  Whether it is Google’s Buzz automatically adding anyone you have ever emailed to your follow list or the multitude of Facebook privacy concerns, it seems that all of a sudden the world is now worried about their privacy on the Internet.  While I can understand why some users wish to have their privacy, I do chuckle a bit inside when I hear people complain that they wish to have privacy on an open and public network.

While this blog post will not be specifically about privacy I do want to state that expecting privacy on the Internet is a bit misguided as no one has ever had privacy on the Internet ever.  Unless you are encrypting every little packet sent from your system, it has been read somewhere by someone for whom it was not intended.  Users are failing to make the connection between acceptable behaviors in the real world vs. acceptable behavior on the Internet.  If you want something to be private you wouldn’t yell it out in a crowded shopping mall, so perhaps you shouldn’t post it on a social networking site. Privacy issues aside, the real topics that interest me when it comes to social networking on the Internet is the various ways that social networking tools become attack platforms. During the recent privacy debates Mark Zuckerberg, founder of Facebook, was quoted in the Washington Post stating the following:

“Facebook has been growing quickly. It has become a community of more than 400 million people in just a few years. It’s a challenge to keep that many people satisfied over time, so we move quickly to serve that community with new ways to connect with the social Web and each other. Sometimes we move too fast.”

If you put yourself into the mindset of an attacker, does 400 million targets all centralized on one fast and ever-changing web application not sound like a great place to play?  Attacks via the Internet are nothing new, but over the last five years we have seen the intent behind attacks shift from mostly harmless annoyances to actual well-planned business models that give an attacker the ability to create an income from successful compromises.  Be that income from rented-out botnet cycles, from spam, theft of corporate secrets, or even the outright stealing of bank funds, today an attacker has the ability to make some real money.  Combine this ability with 400 million targets who are mostly non-technical and running ineffective host-based security solutions, and you have a breeding ground for malicious behavior.  Or, as my grandma likes to call it: “that Facespace thing on the Internet”.

Without getting too platform or site specific - because let’s face it, these days it really doesn’t matter what operating system or browser you use - let’s look at some of the ways that your grandma will get abused via social networking.  I did some very fast brainstorming via email with some very smart colleagues and friends and we came up with some attack scenarios that are all possible today.  I won’t credit each person but you know who you are, so thank you for your input.

Attack Scenario 1:  Malicious add content
The very core of most social network sites’ “business plan” is to generate revenue via advertising content.  This is achieved via partnership deals with the various online advertisers as well as, in some cases, the ability for general users to purchase ad-space that appear in a targeted fashion.  Leveraging this model has actually been done before with much success.  I am sure that there are multiple ways that this can be achieved. The two that pop in to my head immediately are 1) generating an ad that will entice users to click, and therefore be served malicious content or depending on how much html and java -fu you are allowed to use in an ad, or 2) have the ad itself contain malicious content.  This type of attack is actually very simple and in my opinion would probably have a high rate of success.  Remember, your anti-virus and other host-based security products are only protecting you from the threats they know about - meaning anything you throw together will have success until the security vendors collect their samples and write their signatures for it.

Next: More attack scenarios»