Slashdot Mirror
Hackers Target MySpace and Facebook
Stony Stevenson writes "The security firm Fortify Software has warned against a series of attacks against Facebook and MySpace. Buffer overflows that enabled hackers to exploit the Aurigma ActiveX image uploading software used by social networking sites were at the heart of the assault. 'Criminal hackers now view social networking sites as their best target for attacks ... [partially because] such sites are designed to be usable by "unsophisticated" consumers, meaning that the barrier to entry for attacks is potentially lower as users are more likely to click on a link that leads to malware.'"
I assume this is an internet explorer based exploit? http://www.kb.cert.org/vuls/id/776931
Cable, telco and banks and apparel vendors all have young people in their sites. Predatory lending credit cards, special internet "deals" with students and massive advertising budgets that should make the companies involved blush, are aimed at people ages 14 to 25.
Why? because that's where the money is.
Why do the theives use ActiveX exploits? Because they can.
Sheep, meet Mr. Slaughter. Mr. Slaughter .... gross!
And with the way that people spew out personal information on Facebook and MySpace, they probably figure that if they get it just right, there's the potential to hit the motherload of information for identity theft.
Seriously though, who here actually granted MySpace or Facebook access to your email account in order to find your "friends"? Anything else (the social website has access to) is butter in the frosting
It really amazes me just how much personal information people are willing to put on the internet these days. Even if said information is not explicitly granted to a particular website, a great deal can be inferred by people's, for lack of a better term, "blogging" habits.
I, for one, am looking forward to the inevitable
No, dumb people shouldn't use an insecure browser such as IE. Really, just using Firefox takes your threats down by a good 75% even if you are using Windows.
There is no "disagree" moderation, and troll, flamebait and overrated are not valid substitutes
Do your friends and family a favor: educate them on the inherent risks present in the software applications they use on a daily basis. Computer security starts with the user acting in a responsible manner to secure his/her system. If securing the system proves too difficult or time-consuming, maybe it's time to try a different system.
512 MB RAM, 20 GB disk, 200 GB transfer, five datacenters. $19.95/month.
we're not exactly talking about the most sophisticated users on these sites. Why wouldn't they prey on the obviously easy targets.
When people ask if I'm an optimist, I say "I hope so". --Bill Bailey
That is the way that a majority of people on this planet are. They don't learn from their own choices/actions and keep making the same choices/actions over and over again, and people like me have to clean up after them. That is the way my jobs have been for the past thirty years, each computer job I had to clean up after someone else's mess. I had to debug code that makes no sense much less won't compile without errors, into something that actually works and doesn't crash systems within a week or two. No flowcharts, no documentation, hardly any help from anyone, no support from management. Either do it or get fired. Management usually had no idea how programs work, and mostly hire the people they like instead of those qualified for the job. Then the other programmers take smoke breaks to light up a joint, write sloppy code as a result, and then the managers hand it over to me to fix it and make it work. But the stoners get the pay raises and promotions and work with new projects while I get stuck on the "legacy" work. When I worked as a technician, before I was a programmer, people would mess up their own computers mostly by not shutting them down before powering them off, or installing some software neither the company nor employee owns but it damages the system in some way.
I ran two computer companies, and you'd think that people always having problems by using their computers improperly would make more money than a Ghostbusters business in getting rid of ghosts would. But people tend not to pay their bills after you fix their systems, and make the same bad choices/actions as they did before and get infected again. My fault for not having a credit card machine and being nice and offering credit and no terms and pay when you have the money, etc.
Life is like that, a majority of the people in the USA make bad choices/actions. They don't save money for retirement, have unprotected sex with multiple partners and get STDs and AIDS as a result, eat fast food like there is no tomorrow and wonder why they are overweight, do more drugs than Cheech and Chong and wonder why they are so sick as a result, ignore their children and don't raise them right and wonder why they grow up to be sociopaths and do school shootings or end up in a gang, but someone has to fix all of that. The rest of the world is no different. People just don't take responsibility for their choices and actions anymore, and just blame someone else. They act as if George W. Bush ruined their career, made them sick, etc but ignore that it was their own choices/actions that made them the way they are and George W. Bush had nothing to do with 20, 30, 40, years of their own stupidity. In fact we elected a scape-goat instead of a President every four years anyway. Someone to blame for when things go wrong.
Remember, Slashdot does not have a -1 disagree moderation, and no, troll, flamebait, and overrated are not substitutes.
May I mention that hacking Facebook takes no real effort? Simply manipulating a browser's client side input forms (using Firebug, maybe) allows one to post to any Superwall (Faceboo application) whether you are the person's friend or not. Anonymous attakers could put links posing as coming from people's friends on the people's Superwalls. Reasoning: If it comes from my friend, it must be good and safe. The click-rate becomes much higher, and an attacker has just used a form of social engineering to lead people to a malware site. Most applications are not built with security in mind. They just (fatally) assume that the end user would never do such a thing. Dream on, app developers!