Security researcher Nick Sullivan over at Symantec Corporation believes that privacy settings on social networking websites such as Facebook give people a false sense of security that could expose them to phishing attacks. "This illusion of privacy leads people to be a little freer in their disclosure," he wrote in a post to the company's security response weblog. Private information, ranging from e-mail and phone number to physical address, can all be available to the determined phisher or identity thief. One way to do get to the information is to seize control of the account of someone designated a friend or someone in the same network, he said.
Phishers can easily engineer fake notifications that follow the format of legitimate friend requests e-mailed to Facebook members, for example. A typical e-mail would ask a user to click on a link to confirm that they are friends with an individual requesting addition as a friend on the network. Some users almost reflexively log in to a site through a link provided in an e-mail, he noted. "This simple, clean design is very easy for a phisher to mimic. … This makes Facebook users ideal targets for the type of generic phishing attacks that are usually directed at financial institutions."
News source: CBC News
Phishers can easily engineer fake notifications that follow the format of legitimate friend requests e-mailed to Facebook members, for example. A typical e-mail would ask a user to click on a link to confirm that they are friends with an individual requesting addition as a friend on the network. Some users almost reflexively log in to a site through a link provided in an e-mail, he noted. "This simple, clean design is very easy for a phisher to mimic. … This makes Facebook users ideal targets for the type of generic phishing attacks that are usually directed at financial institutions."
News source: CBC News
-Spenser
-Spenser
Heh. I think the idea is that most people don't do that, that's why phishing e-mails work! So unfortunately, rather than fix user behaviour (ideal), we're stuck with patching user behaviour instead (don't have Facebook send e-mail).
-Spenser
As above, or turn all messages off. Suprise suprise, you have yourself no problems.
Any social networking site, or just any website frequented by people that come from non-technical background (in case you haven't noticed, they outnumber us geeks who know which site to click and which not to) is "Ideal" for phishing attacks.
I honestly envy the job of these so-called "researchers"
Check this out, Symantec: Since Facebook doesn't rely on encrypted data transmission, there is no "illusion of privacy". No data exchanged on a website that's not secure (http://) is private.
Symantec actually pays this guy?
Commenting has either been disabled on this article or you are not logged in. Click here to login or register, its free!
Note: Anonymous commenting is disabled in order to keep the quality of responses to a high standard.