Facebook, Android and the evil in between

CSO published two stories yesterday about Facebook as an increasingly dangerous place. It wasn’t news to me.

I’ve been seeing the evidence for some time now, and we’ve been writing about it for more than two years.

First, my colleague Joan Goodchild wrote about a BitDefender report that flagged Facebook as a major attack vector for smart phones. From the article:

The biggest mobile infection threat isn’t malware that specifically targets mobile devices, according to new research from security firm BitDefender. Malware that targets Facebook is a far bigger problem for mobile security, the firm claims. Spam links on social networks are infecting mobile devices via bad links on Facebook because the worms and other malware are often platform-independent and are widely spread as malware that targets PCs.

BitDefender officials point to Google statistics, which reveal almost one quarter of Facebook users who fell for a recent scam on the social network did so from their mobile device. The URL that was studied was one that claimed to show users a girl’s Facebook status which got her expelled from school. It generated 28,672 clicks — 24 percent of which originated from mobile platforms. Users who clicked on the link — whether on their PC or mobile device — downloaded a Facebook worm and fell victim to an adword-based money grabbing scheme.

As Joan was writing this, I was in a nearby conference room chatting with Sophos tech consultant Graham Cluley about Facebook and other social networking platforms. He reached the same conclusions as BitDefender and added that Android phones are the easiest target against the venom coming from Facebook:

“The iPhone operates in a more controlled environment and the BlackBerry security model is fairly strong. Because Android operates in a more open environment, it’s more open to infections,” Cluley said.

Given the growing popularity of Android phones in the enterprise, Cluley said this is something IT security shops must be more aware of.

The malware being sent to the phones via Facebook messages are the garden-variety spam messages that rely heavily on social engineering tactics. A Sophos threat report due out next week will dive more into the social networking threat, but the company’s just-released “Dirty Dozen” spam list also mentions it.

“Spam is certainly here to stay, however the motivations and the methods are continuing to change in order to reap the greatest rewards for the spammers,” Cluley said.

“Great,” I thought to myself. I use an Android.

Fortunately, I’ve been well aware of Facebook social engineering tricks for some time.

I know better than to click on a link that says something like this: “Click here and see what happened after this girl’s dad caught her on the webcam.” That message came with a thumbnail shot of a girl’s backside, clad in Catholic school uniform. I didn’t have to click a link to see that it was trash.

Then there’s the social engineering trick that speaks to our vanity: “Click here to see who’s been looking at your profile.”

Before I come off as too smug, I should note that I’ve clicked sinister links before, particularly those disguised as news updates. I’m getting smarter about that, but when you have several windows open at once and you’re multi-tasking, you’re at a higher risk of doing stupid things.

There’s another Facebook risk I’ve noted in recent months: The place attracts all kinds of dangerous people who are there looking for prey. A kid I grew up with in Revere, Mass., was on there over the summer, making friends with a lot of teenage girls from remote corners of the world. It turns our he’s a thrice-convicted pedophile.

There’s no doubt about it: The social networks are full of dangerous alleys and we have to watch out backs.

That’s especially true if you’re looking at one of these sites from an Android, BlackBerry or iPhone, where you can’t always see things as clearly as you would in front of a laptop screen.

–Bill Brenner