Facebook “Un Named App” scare leads to malware

Excellent write up by Trendmicro on the ‘un named app’ discussion that is spreading on Facebook. If you search Google for this, you may be tricked into downloading Malware to your machine and get compromised.

Here is the article.

[…] Nothing to worry about here as far as your Facebook is concerned, this does not appear to be a genuine malicious app. In fact a thread on Yahoo answers appears to demonstrate in a reproducible fashion that “Un named App” is nothing more than your “Boxes” tab on your Facebook profile page.

Beware though, there is still real risk attached to this Chinese whisper. Criminals have picked up on the concern among Facebook users (or possibly they were responsible for starting the rumour?) and they have already started to poison Google search results.

Google search result:

Google search result

I queried Google for “facebook unnamed app” and the third result on the first page pointed to a malicious website set up for the purposes of distributing fake anti-virus software, this time called “Security Tool”. If you are unwary enough to click the link you will be presented with a dialogue box informing you that you have a huge number of infected files on your machine and prompting you to use Security Tool to clean them up. The software of course is no real security solution and is designed to fool the victim into parting with hard-earned cash.

Be careful what you surf for.

Social Security Numbers Deduced From Public Data (available on e.g. Facebook)

Interesting article on Wired. Researchers are able to predict correct Social Security Numbers based on minimal information, like date of birth and birth town they mined from social network sites.

Excerpt:

After developing an algorithm […], the researchers tested their results using information on birthday and hometown taken from a social networking site […] . Again, they were able to predict Social Security numbers with a high degree of accuracy.

Again, this confirms my recommendation to NEVER use personal information on public social network sites like Facebook etc. Don’t put your real birth date, birth town etc. on there, it is bound to be used for things much less harmless than birthday reminders.

Full Wired article at:

http://www.wired.com/wiredscience/2009/07/predictingssn/

Facebook worm steals account passwords

Apparently there is a new (old, but resurfaced) worm out there that spreads through Facebook.

From Computerworld,

[…] the newest Koobface tries to dupe users into clicking on a link that’s included in a message from a friend. Clicking on the link displays a fake error message claiming that Adobe System Inc.’s Flash is out of date, and prompts the user to download an update.

The update is nothing of the sort, but is instead an executable file that installs the Koobface worm.

[…] rifles through a compromised PC, sniffs out browser cookies associated with 10 different social networking sites, uses the usernames and passwords within those cookies to log on to each service, searches for the infected user’s friends and then sends those people messages that include a link to the worm.

It looks for cookies connected to bebo.com, Facebook, Friendster, fubar.com, hi5.com, LiveJournal, MySpace, myYearbook, Netlog and Tagged.

I fully agree with the last statement:

Users need to be very, very careful about what they install when they’re on these [social networking] services,” […] “And they should be careful about how they use social networks and what information they put on them. The criminals are gleaning all the information they can and using it against you.”

Over 330 institutions affected by Heartland Security Breach, number growing

In reference to the breach of the payment processor Heartland Payment Systems, as I mentioned a couple of weeks ago, more and more institutions are admitting that they are affected by this issue, which means that their customers’ credit card transactions may have been compromised.

The list of instititutions that are affected so far can be viewed here. It does include major banks, so you may want to skim over it, see if your bank in your state is listed and then contact them for more information.

Staff Finds White House in the Technological Dark Ages – Security Challenges

In this Washington Post article, new staffers describe the state of the IT infrastructure at the White House.

Excerpts:

Two years after launching the most technologically savvy presidential campaign in history, Obama officials ran smack into the constraints of the federal bureaucracy yesterday, encountering a jumble of disconnected phone lines, old computer software, and security regulations forbidding outside e-mail accounts.

What does that mean in 21st-century terms? No Facebook to communicate with supporters. No outside e-mail log-ins. No instant messaging. Hard adjustments for a staff that helped sweep Obama to power through, among other things, relentless online social networking.

[…]

One member of the White House new-media team came to work on Tuesday, right after the swearing-in ceremony, only to discover that it was impossible to know which programs could be updated, or even which computers could be used for which purposes. The team members, accustomed to working on Macintoshes, found computers outfitted with six-year-old versions of Microsoft software. Laptops were scarce, assigned to only a few people in the West Wing. The team was left struggling to put closed captions on online videos.

[…]

Another White House official whose transition cellphone was disconnected left a message temporarily referring callers to his wife’s phone.

Several people tried to route their e-mails through personal accounts.

[…]

And officials in the press office were prepared: In addition to having their own cellphones, they set up Gmail accounts, with approval from the White House counsel, so they could send information in more than one way.

This should be interesting for any security/process-oriented folks in the White House administration. Having hundreds of rampart Gmail/IM accounts active will definitely pose a challenge for the system. Since all official administration communication needs to be logged for legal purposes, I am curious as to how they will catch up with all the emails that will be sent through Gmail in the upcoming months. They will have a hard time quitting using their Gmail accounts once the official White House accounts are established. Also, what kind of information will be sent via their Gmail accounts? I definitely hope that they will not be able to use instant messaging, unless all that communication will be logged.

It is a brave new world that is out there, it has never been more challenging for security-minded folks.