Anti-Social Networks

3:50 PM -- I received a press release from Sophos yesterday with the ridiculously long title "Sophos Facebook ID Probe Shows 41 percent of Users Happy to Reveal All to Potential Identity Thieves." My first reaction was... "Duh!"

The security problems on social network networking sites have been evident for some time now. We all know that these sites are a drain on productivity. I'm stunned by how much time both students and professionals spend on these sites. It is the new addiction. Forget rushing to the bar after work -- employees are now getting their fix by posting useless messages like "OMG! Did you see what that sales rep was wearing?" or "Dude, your server just got pwned!"

Not only are these sites a drain, but they could cost you a job. Many companies today do online searches (or hire a third party) to find out what they can about a prospective employee on the Web. Kudos to those employers, and a warning to those who speak loosely about their current employers on social networking sites. (See Leak Hunters.)

Finally, social networking sites are enablers for attackers. They've been used for spam, phishing scams, and cross-site scripting (XSS) attacks. Even stalkers and pedophiles use them to find new prey. It seems elementary that identity thieves use them to find new targets, and it certainly seems likely that they are also used by corporate spies.

Of course, social networking sites aren't the only sources of personal information. Much of this data could be obtained from any number of other Websites -- including phone numbers, email addresses, birthdates, and physical addresses. Most social networkers are not handing over their Social Security Numbers or credit card information. But for an attacker who looks hard enough, there's plenty of useful information there.

When you or your employees transmit data, even socially, consider what might happen if that data is exposed online. If you are an enterprise IT worker, you should be aware that the questions you post to mailing lists could be used to enumerate what security measures you have in place.

If you are responsible for security in your organization, you should think long and hard about implementing a policy restricting social networking site usage. Alternatively, consider hiring a third party to surf these sites every couple of weeks to see what your employees may be leaking about you. The message that the Sophos study delivers may not be new, but we can thank them for the reminder.

— John H. Sawyer is a security geek on the IT Security Team at the University of Florida. He enjoys taking long war walks on the beach and riding pwnies. When he's not fighting flaming, malware-infested machines or performing autopsies on blitzed boxes, he can usually be found hanging with his family, bouncing a baby on one knee and balancing a laptop on the other. Special to Dark Reading