Social networking and mobile devices call for right policies

Stephen Withers
Thursday, 02 September 2010 18:32

Business IT - Security

IT infrastructure provider Dimension Data is advising its clients to formulate appropriate policies about the use of social networking and mobile devices.

Dimension Data senior security consultant Ed Luck said that Facebook presents "a massive attack surface." Part of the problem is that there are more than one million developers and entrepreneurs involved, and Facebook doesn't pre-screen apps - it waits until complains are received and then investigates.

The Facebook API presents multiple opportunities that can be exploited by malware writers. For example, the API is vulnerable to 'man in the middle' attacks between a client and a legitimate application server, and Luck also suggested that it wasn't a major challenge to arrange for the server behind one externally supported app to send a message to another unrelated app (spoofing).

"We have to live through the bad part of the [security] cycle before it stabilises," he warned.

Privacy is another issue, though one that doesn't seem to be taken seriously by most Facebook users. 89% of then use their real name, and 61% use an identifiable picture, Luck said. The problem for organisations is that information available via social networks can be used as an entry vector to internal networks. One example is that such information can be used for spearphishing or social engineering attacks - the more you know about someone, the easier it is to compile an email message that will appear trustworthy because it appears to come from a known source and contains subject matter that might be expected from that person.

Is your company likely to be attacked?, Luck asked. Maybe, maybe not - but he suggested that mining companies are a good example of organisations whose secrets are of great interest to competitors and to certain governments.

And developments like Facebook Places and foursquare reveal people's locations - very useful if you want to pickpocket a particular person's mobile device when they're in a crowded bar, or when you want to be confident they will be away from their desks for a certain period.

So what do you do? Please read on for some of Luck's suggestions.