Facebook shrugs off warning to vet potentially malicious programs
Social networking site's users under attack from programs seeking to steal personal data, says expert
Facebook must revise its policy on letting programs that have not been previously vetted for malicious intent be unleashed on the site, a web security expert has warned.
But the founder of the five-year-old social networking site, Mark Zuckerberg, insists that he will not put such safeguards in place – arguing that "an open system anyone can participate in is generally better."
Rik Ferguson, senior security advisor at Trend Micro said that in comparison to vetting procedures at rival social networking site MySpace and Apple's iPhone App Store for the iPhone, Facebook's hands-off policy – whereby anyone can offer a program for use by Facebook's 175 million users – will contribute to a growth in rogue applications, and that users should be wary of any new or fast-spreading ones they encounter.
Ferguson says he has monitored four malicious applications in the past week alone, as well as the resurgence of the "Koobface" virus, first seen last July, which sends out intriguing-sounding links to friends of an infected user, who is then tempted to a "video" page which instead infects their computer. Only PCs running Microsoft Windows are at risk.
"The [Facebook] policy is facilitating the growth of rogue applications, and making it easier," Ferguson said. "If Facebook does nothing, they will continue to increase.
"This feels like a test run for something more malicious in the future. It may be about stealing identities, or it may be much more."
An application called "Error Check System" warns that friends are having problems accessing a user's profile, while two called "Closing Down" try to get users to install an application to prevent their profile being shut down for "violating Facebook's terms of use" – telling the target to visit a page to answer a charge that they broken the site's conditions of use.
The applications appear to be trying to gather personal information, but because Facebook hosts all user data and the data related to applications, it is impossible to tell how much information these rogue apps have gathered, said Ferguson.
It is possible that the information could contribute to identity theft by scraping contact details, siblings and pets' names and maiden names, some of which can be to trick users into handing over passwords in sophisticated "phishing" scams.
"The speed with which these applications have spread comes down to the classic combination of fear, uncertainty and doubt," said Ferguson. "It's because these messages appear to come from friends that makes them so powerful."
Speaking to the BBC, Facebook founder Mark Zuckerberg insisted that the site would not start vetting applications before they go live on the site.
"Our philosophy is that having an open system anyone can participate in is generally better," he said. ""When we were starting this we wanted anyone to be able to develop an application. This has made it so students in their college dorm rooms could build applications for free. That's how I got started with Facebook. We really want to make sure that sort of innovation is possible."
A Facebook spokesman said the malicious applications and the more severe Koobface worm had affected only a small percentage of its users, and that it provided detailed advice on its security page.
Koobface last struck the site in December, posting comments on profiles which contain links that will download the virus to a user's PC, and also affected rival social networking sites MySpace, Bebo and Friendster.
Ferguson, meanwhile, advised users to regard every message on Facebook as "guilty until proven innocent".
He said users should set their profiles to private rather than allowing them to be indexed by search engines, and advised that they remove phone numbers, family names and travel plans.
"And just because a message seems to come from a friend, don't believe it. We give these messages more credibility because they come from someone we know but every message should be treated with caution."
Jemima Kiss
Monday 2 March 2009 17.25 GMT
guardian.co.uk © Guardian News and Media Limited 2009
Social networking site's users under attack from programs seeking to steal personal data, says expert
Facebook must revise its policy on letting programs that have not been previously vetted for malicious intent be unleashed on the site, a web security expert has warned.
But the founder of the five-year-old social networking site, Mark Zuckerberg, insists that he will not put such safeguards in place – arguing that "an open system anyone can participate in is generally better."
Rik Ferguson, senior security advisor at Trend Micro said that in comparison to vetting procedures at rival social networking site MySpace and Apple's iPhone App Store for the iPhone, Facebook's hands-off policy – whereby anyone can offer a program for use by Facebook's 175 million users – will contribute to a growth in rogue applications, and that users should be wary of any new or fast-spreading ones they encounter.
Ferguson says he has monitored four malicious applications in the past week alone, as well as the resurgence of the "Koobface" virus, first seen last July, which sends out intriguing-sounding links to friends of an infected user, who is then tempted to a "video" page which instead infects their computer. Only PCs running Microsoft Windows are at risk.
"The [Facebook] policy is facilitating the growth of rogue applications, and making it easier," Ferguson said. "If Facebook does nothing, they will continue to increase.
"This feels like a test run for something more malicious in the future. It may be about stealing identities, or it may be much more."
An application called "Error Check System" warns that friends are having problems accessing a user's profile, while two called "Closing Down" try to get users to install an application to prevent their profile being shut down for "violating Facebook's terms of use" – telling the target to visit a page to answer a charge that they broken the site's conditions of use.
The applications appear to be trying to gather personal information, but because Facebook hosts all user data and the data related to applications, it is impossible to tell how much information these rogue apps have gathered, said Ferguson.
It is possible that the information could contribute to identity theft by scraping contact details, siblings and pets' names and maiden names, some of which can be to trick users into handing over passwords in sophisticated "phishing" scams.
"The speed with which these applications have spread comes down to the classic combination of fear, uncertainty and doubt," said Ferguson. "It's because these messages appear to come from friends that makes them so powerful."
Speaking to the BBC, Facebook founder Mark Zuckerberg insisted that the site would not start vetting applications before they go live on the site.
"Our philosophy is that having an open system anyone can participate in is generally better," he said. ""When we were starting this we wanted anyone to be able to develop an application. This has made it so students in their college dorm rooms could build applications for free. That's how I got started with Facebook. We really want to make sure that sort of innovation is possible."
A Facebook spokesman said the malicious applications and the more severe Koobface worm had affected only a small percentage of its users, and that it provided detailed advice on its security page.
Koobface last struck the site in December, posting comments on profiles which contain links that will download the virus to a user's PC, and also affected rival social networking sites MySpace, Bebo and Friendster.
Ferguson, meanwhile, advised users to regard every message on Facebook as "guilty until proven innocent".
He said users should set their profiles to private rather than allowing them to be indexed by search engines, and advised that they remove phone numbers, family names and travel plans.
"And just because a message seems to come from a friend, don't believe it. We give these messages more credibility because they come from someone we know but every message should be treated with caution."
Jemima Kiss
Monday 2 March 2009 17.25 GMT
guardian.co.uk © Guardian News and Media Limited 2009
