Research from Kaspersky Lab shows malware on social networking sites such as Facebook and MySpace is 10 times more successful at infecting users than e-mail-based attacks. Enterprises and users need to adopt sound security practices to deal with the problem.
hackers are using sites such as Facebook, LinkedIn and MySpace to launch
attacks is no revelation. New statistics, however, show just how
on social networking sites
its "Malware Evolution 2008"
report, published in February 2009, Kaspersky
revealed that malicious code distributed via social networking sites has a
success rate of 10 percent in terms of infections, making it 10 times more
potent than malware distributed via e-mail.
2008 we increased the collection of malicious files relating to social networks
by approximately 26,000," said Stefan Tanase, a security researcher for
the Kaspersky Lab Global Research and Analysis Team. "In 2008 alone we
processed more of those samples than in the total of all years prior to 2008,
making the growth rate exponential. Our collection of malicious
reached 43,000 at the end of last year."
said he expects that number to hit 100,000 by the end of 2009. According to
800 new variants of the notorious Koobface virus were discovered in
March alone. Social networking sites have also been hit by malware hidden
legitimate third-party applications.
particular site is more dangerous than others, Tanase said. Different sites are
popular in different regions of the world, and attackers follow the users.
very hard for social
networking sites to do better,
" he said. "Their business is about
having an easy-to-use Website, so that everyone can join. The problem is that
usability and security don't really go hand in hand most of the time."
enterprises, that means developing policies to control the use of social
networks by employees. Organizations can instruct employees not to mention the
company name on social networking sites, for example, and can couple that with
education on configuring privacy settings and general Web safety.
access to social networking site[s] is not going to work in the long run,"
said Chenxi Wang, an analyst with Forrester Research. "As younger
employees join the work force, they increasingly expect to have access to
social networking sites from work, [so] having such a restrictive policy will
damage the company's [prospects of attracting] employees and ultimately may
become a competitive advantage [to competitors]."
for basic security advice, Tanase advised users to limit the code executed
inside their browsers to trusted sources only and to make sure the operating
system, anti-virus application and other software are fully patched and
talking about social networks, even though they are made of users wandering
throughout cyber-space, we should not forget we're actually talking about real
people, actual human beings that have friends and relationships," he said.
"These relationships are usually based on trust, so the bad guys are
trying to exploit this trust."