eWEEK content and product recommendations are editorially independent. We may make money when you click on links to our partners. Learn More.
Facebook is sparring with security firm Sophos over a threat report touching on malware on social networks.
In a report looking back (pdf) on 2010, Sophos reported that a survey of 1,273 people in December 2010 found that 40 percent had been sent malware via social networks, up from 36 percent in December 2009. Additionally, 43 percent admitted being sent phishing attacks, while 67 percent said they had received spam. Both of these numbers were up from December 2009 as well, with previous figures of 30 percent and 57 percent, respectively.
“This isn’t just a problem for home users,” noted Graham Cluley, senior technology consultant at Sophos. “Many people check their social networking accounts from the workplace, making the sites a potential vector for attacks against businesses.”
“There’s no doubt that cybercriminals are showing a much higher level of interest in the social networks than ever before, with Facebook being the site they are targeting the most,” he added.
Though Facebook acknowledged the challenge posed by security threats, the company took issue with the idea that the social network is a malware minefield. On the contrary, a Facebook spokesperson told eWEEK, the company’s data shows that malware, spam and other attacks have decreased in their effectiveness, and it is “much more important to measure effectiveness than it is to measure volume.”
“If your spam filter catches all the spam, does it matter that your filter caught 10 percent more?” the spokesperson asked.
Facebook contends it has built more controls into the site to allow users to limit the data that applications are allowed access to, providing a defense against rogue applications by forcing disclosure and user consent to access. The site also works to quickly sanction or remove applications found to be malicious, the spokesperson said.
“We have a dedicated team that does robust review of all third-party applications, using a risk-based approach,” the spokesperson told eWEEK. “That means that we first look at velocity/number of users/types of data shared, and then we prioritize. This ensures that the team is focused on addressing the biggest risks, rather than just doing a cursory review at the time that an app is first launched.”
Still, Sophos is not the only security company sounding the bell about attacks on social networks. In November, researchers at BitDefender reported that 22.4 percent of the users of its safego application were exposed to malicious posts on Facebook.
“I see two possibilities,” blogged Cluley. “Either Facebook simply doesn’t get security and privacy. Or it just (doesn’t) care. I really hope it’s the former.”
On Jan. 16, Cluley criticized Facebook for allowing applications to access users’ mobile phone numbers and address information, a decision the company rescinded Tuesday after privacy concerns were raised. Despite the controversies regarding security, Facebook said it continues to educate users through the Facebook Security Page, as well as the through the remediation and education process users are put through if their account is found to have been compromised.
“We wholeheartedly agree that education and awareness is the key to combating online security threats and that this issue is something we need to tackle together as an industry,” the Facebook spokesperson said. “For our part, we have launched numerous education initiatives and continue to invest heavily in developing complex and innovative systems to protect the people who use Facebook.”