I will be speaking at MITRE’s Social Media Strategy and Implementation Workshop in the Washington, DC area on September 28th. My topic is Attacking Social Networks. The goal of the talk is to show some of the darker aspects of social networking. These will be items and attack vectors that people may not be thinking about. Believe it or not some people are still oblivious to common social network attacks 
If you are in the DC area stop on by.
Business social network LinkedIn announced their LinkedIn Applications today. The applications directory can be viewed here There are only several applications to chose from at the moment. I am sure that number will grow soon. LinkedIn uses Google’s OpenSocial just like other social networks such as MySpace, Orkut, hi5, etc. I only spent like 5 minutes looking at a couple of things. So, the following are only my quick thoughts and impressions.
The applications are delivered though the domain lmodules.com. This makes them easy to identify and block if that’s what you would like to do.
At first glance it appears that the vetting process for LinkedIn is higher than some of the other social networks. They appear to only want known businesses to create applications for their network at this time. This would help root out some possible malicious users. A vetting process is a good first step in thwarting that type of malicious behavior. I didn’t look at the difficulty in attaining a developer account, but I am assuming it is much more difficult than other social networks like MySpace, Facebok, etc. Now, whether this vetting process will stay this stringent will remain to be seen. These procedures may be relaxed in the future due to demand.
Just because the name has changed doesn’t mean the threats have changed. As a matter of fact there may actually be more on the table. Business networks such as LinkedIn are more likely to contain real information about people vs other non-professional social networks. Not that people don’t share enough about their real self on other social networks. This means the same threats exist for the capture of information as on other social networks.
There are still technical threats from social network applications on LinkedIn as well. These are the very same issues as other social networks that we have discussed in the past and demonstrated. Malware distribution, social engineering, attacking clients, information harvesting, click fraud are just some of these threats from social network applications. Moral of the story is be careful. Don’t install apps you don’t need, even though you may do so on your iPhone
So all in all the threats are the same with LinkedIn as any other social networks that employ applications. However, with a more stringent vetting process this should reduce the possibilities for malicious by making accounts harder to get.
For those of you that care, there is a caricature of me on the cover of the November issue of CPU Magazine. In the back of the magazine there is some Q&A with me mostly about social networks. It’s probably stuff you have heard Shawn and I say before, but cool nonetheless. So if you are in your favorite book store check out the magazine and see what you think.
Hello Everyone. I just wanted everyone to know that Shawn Moyer and I will be speaking at PhreakNIC 12. We are going to do the Satan is on my Friends List talk again. There were people who didn’t get to see it out in Las Vegas, and well, since BHJP is in a different part of the world we figured if people still wanted to see it we would do it again in the United States. We will have some updates so it won’t totally be the same talk we did in Vegas.
If you aren’t familiar with PhreakNIC it is a small conference in Nashville, TN. It’s loads of fun, there is great people, great conversation, and no vendor overload. I highly encourage people to go.
Recently Facebook announced their Application Verification Program in an attempt to give user’s assurances that particular applications are secure. I think the intent is good but the implementation may actually cause more harm than good. Giving users an assurance that a malicious applications are secure can cause a lot of damage. People with assurances are a lot more loose with their actions where they may normally not be with no expectation of security.
Given the way many of Facebook’s applications are written it doesn’t lend itself to a proper review. The Facebook team is going to have to do reviews of submitted code that does not run on Facebook servers. This would only be a snapshot of the code at that given time. After the verification procedures are done, the developer can make whatever changes they want. They could change the verified app to a malicious app at will. I am getting so tired of security measures that don’t address the real problems. They are a waste of time. The only thing this verification program may do is stop the idiot who just learned PHP from creating the HackMe Back of social network applications. It doesn’t address the major problem that attackers are gaining access to the API and attacking social network users.
The best way to protect against malicious applications is to control the access to the API in the first place. Don’t just let anyone access the API and only need 5 friends to publish the app. Proper vetting procedures would go a long way in curbing the amount of malicious applications that get published on Facebook and other social networks. Why don’t the major social networks have vetting procedures for API access? It completely blows my mind, but that’s social network culture for ya.
Social networks are riding a thin line with security as it is. Introducing security measures that aren’t effective only cause more confusion on the part of their users. Social networks should strive to create a balance between functionality and security for everyone’s sake. Will that happen? Only time will tell. One thing is for sure though, attacks on social networks are only going to go up. The more surface you give an attacker the more options and success they are going to have.
