Slashdot Mirror

← Back to Stories (view on slashdot.org)

Social Networking Sites Full of Security Holes

Posted by CmdrTaco on from the 2.0-is-harder-than-1.0 dept.

athloi writes "Social networking Web sites such as MySpace.com are increasingly juicy targets for computer hackers, who are demonstrating a pair of vulnerabilities they claim expose sensitive personal information and could be exploited by online criminals."

10 of 76 comments (clear)

  1. I'd say the real threat isn't holes, but ho's by elrous0 · · Score: 5, Insightful

    It wasn't a security hole that allowed someone to blackmail Miss New Jersey. The real danger of these networking sites are dumbasses who post embarassing pictures and blogs about themselves IN THE OPEN, not anything a hacker needs to dig for.

    --
    SJW: Someone who has run out of real oppression, and has to fake it.
    1. Re:I'd say the real threat isn't holes, but ho's by Spy+der+Mann · · Score: 3, Insightful

      Yes, but assume that some sites DO implement security features like only allowing your data to be shown to your "buddies". What happens when these security measures get broken?

      The other day i could watch a demonstration of a XSS attack on meebo due to lack of server-side validation.

      Now add a little AI / data mining to this:

      (New entry, mo/day/yr) "Here's a picture of me and my daughter Jessica playing on the NN. park" -> AI -> name: Jessica. Picture: (insert here). Last seen on: MMDDYY. Location: NN. Park.

      There! You could make a database of potential victims for threats, blackmailing, and what not. The only thing that makes me feel safe is that such AI data mining technology hasn't been developed... yet.

      As a rule of thumb, follow Murphy's law: What can go wrong, WILL go wrong (remember the recent SSN leaks?) Unless social networking sites have been PUBLICLY certified as having greater security than Fort Knox, stay away.

  2. A Net is a Bunch of Holes Sewn Together by Doc+Ruby · · Score: 3, Insightful

    Is giving your personal data to a company that sells it to spammers or anyone else with a buck when they start going bankrupt a "security hole"?

    --

    --
    make install -not war

  3. i wouldn't be surprised by sleekware · · Score: 5, Insightful

    i wouldn't be surprised to find out that most of the hacked accounts had passwords that were something that was listed under the favorite things on a user's profile.

    1. Re:i wouldn't be surprised by Catil · · Score: 2, Insightful

      There is another possible "attack-vector" - most email-accounts still offer or even require a security-question like "what is my pet's name?"
      Some of these can porbably be answered by anyone reading the profile or blog of someone else; and once you got access to the email-account, you could use the forgot-password-option on almost all other websites, including ebay and paypal.

  4. No SSL by jerbenn · · Score: 3, Insightful

    How can anyone expect to keep their myspace login credentials private when they don't even have the login page SSL'd? Those bunch of retards!

  5. Stereotyping? by Andy+Dodd · · Score: 4, Insightful

    "Yet another MySpace security hole" somehow translates to "All social networking sites are full of holes"?

    Just a LITTLE bit of stereotyping in the article title I think?

    --
    retrorocket.o not found, launch anyway?
  6. They really don't care about the end user... by DeVil.DeMonde · · Score: 2, Insightful

    What I find funny is the fact that most of the poor souls that go to such sites looking to connect with other people are on a site where the people in charge couldn't care less... I signed up for My(waste of)Space when it showed up on the net because for some people I knew it was the only means to reach them any longer. I canceled my ISP and switched since then, asking the OZ like people running the show to please update my e-mail to reflect this change, more than a year has gone by. Has my e-mail been changed? Nope. Do I waste my time on MySpace anymore? Nope.

    When you refuse to acknowledge the community you "support" sub-par quality is what you must expect. Now if those MySpace people want to reach me they have to track me down via other means. To limit yourself to one medium of communication is sad anyway. Pidgin for everybody.

  7. Re:Perhaps ran into one of these by HeavyDevelopment · · Score: 2, Insightful

    Yes turning off Javascript pretty much invalidates the whole Web 2.0 experience doesn't it? But on the other hand, you open yourself to a bunch of security issues if you don't. Quite the little conundrum....

    --
    Badges!?! We don't need no stinking badges!
  8. user-submitted HTML content bad by rainmayun · · Score: 2, Insightful

    Well of course they are. Any site that allows random users to post HTML content that then gets embedded in the site's pages (especially as extensively as sites like Myspace, etc allow it) is going to be subject to security flaws. Moral of the story: browse such sites using a secure browser, at least as secure a browser as you can find.