Introduction
Facebook
is a very popular social networking site, but there are a number of
security issues with the site that can put you at serious risk if you
aren't careful. The number of facebook account hackings seem to be on
the increase (at least I've been getting more bogus messages recently),
and this page is in response to a friend who asked what to do after
her account got hacked.
While
any online account is in danger of being hacked, Facebook has unique
features that make this danger even more likely. For one thing, it is
very common to post personal information which can be used to steal your identity.
But the significant danger is because it is so easy to run malicious
programs that can hack your account. In particular, be very careful
using any application that asks to access your profile.
Keep
in mind that if your account is compromised, not only is your
personal information exposed, but the personal information of all your
friends as well. So, even if you don't have anything sensitive in
your profile information, your friends might. Every time you take one
of those quizzes on facebook, you are risking your information and
that of your friends.
Prevention Techniques
It
is much easier to prevent having your account hacked than to recover
from a hacked account. Here are some good security practices that you
should keep in mind not only for Facebook, but for any other web site
account you might have.
- Don't use Internet Explorer
- There are a lot of security problems with IE. I recommend that you use Firefox instead. Other possible browsers are Safari and Opera, along with the new Chrome from Google.
- One of the nice things about Firefox is all of the add-ons you can get. Some of the add-ons that I consider essential are:
- Adblock Plus — you don't see any ads
- NoScript — won't allow a web site to run Javascript unless you give it permission
- Never click on a link
- Never click on a link contained in any e-mail message or IM. Also, never type a URL directly into the address bar of your browser.
- When you get an e-mail with a link, don't click on it. Hover your mouse over the link and right-click the mouse, and select "Copy Link Location" in Firefox. Next, paste the link into Google and click on search. You should see at the very top of the search results the page you expected. If, however, you see comments about phishing, malware, etc. then you know not to go there.
- If somebody tells you a URL to type into your browser, ignore them. Instead, type the URL into the Google search bar and hit ENTER. As above, you should see the page you were expecting. If not, then either you made a typo, the person giving the URL was wrong, or the site is dangerous.
- It is a common practice by malware writers to purchase domain names similar to valid sites, especially commonly mispelled names. They then set up a web site that looks the same as the real site. When you click on any link on the bogus site, you run the risk of downloading malware. These sites will also try to get the user to enter passwords or personal information.
- Use a strong password
- Find a balance between a password that is easy for you to remember and one that is hard to guess. It should have at least 6-8 characters, and should include letters and digits or possibly symbols. You should never use any word that would appear in a dictionary, the names of your pets, spouse, kids, friends, etc. There are several techniques you can use to do this:
- One trick is to make up a saying or phrase and then use the first letter of each word, or possibly a symbol to represent the word. For example, let's use the phrase "This is my secret password for facebook." We could make that "t=msp4fb". We could emphasize certain words to make the password even stronger: "THIS is my SECRET password for FACEbook" can become "T=mSp4Fb"
- You can make up your own symbols for words, such as "=" for is or equals, "<" for less than, before, left, etc. and ">" for greater than, after, right, etc. There is a special language call leet that might give you some more ideas for symbols. If you use leet, you might want to type short words in leet rather than just the first letter. Be careful using uncommon symbols, some systems might have problems with strange characters in the password field.
- Don't use the same (or similar) password for more than one site. At a minimum, make sure your Facebook password is completely different than your password for any other site.
- Don't Give Out Your Password
- Of course, having a strong password doesn't help if you give your password to others. Although you hopefully would not give your password to a stranger, there are many ways in which malicious users can trick you into revealing your password. A common way is to create web sites that look like legitemate web sites, and when the victim attempts to login, their user name and password are saved and used later to hack into their account.
- Facebook offers a very sneaky way of getting you to enter your user name and password: by offering to help you find your friends on facebook. Facebook asks you for your email address and password, and then uses this information to access your address book / list of contacts. They then search facebook for any matches. The problem, of course, is that your email address and password are now stored inside a facebook database. And, since facebook doesn't have a history of keeping your private information very private, you should be very concerned about that. If you want to find friends on facebook, search for them using their email address.
- If you have already given out your email address and password, change your password immediately. If, in the future, you need to enter that information, I would recommend that you login to your email account, change the password to something simple (like "secret") and then submit that password. Once you have done what you needed to do, go back into your email account and change your password to something strong.
- Always logout when you are done
- I recall using a public terminal, and going to LinkedIn, and was surprised to find myself logged in as someone else. If you don't logout when you are done, you risk having somebody else do things with your account or download key loggers, malware, etc.
- Some web sites use cookies to remember who you are so that you don't have to sign in each time. While this might be convenient when using your desktop at home, it can be disasterous on your laptop, cell phone, or PDA. When you logout, that usually destroys the cookies so that you will have to login the next time.
- Change your password fairly often
- If you change your password too often, it makes it hard to remember, and you might start writing it down, which would be very dangerous. The idea is to change your password often enough so that by the time somebody figures out your password, you have changed it.
- Make sure you don't have a pattern between different passwords. If your password is secret1, then secret2 isn't a good password. (Of course, secret1 is a lousy password to begin with.)
- Don't let others use your computer, phone, PDA, etc.
- I realize that some of your friends might think you are strange if you don't let them use your computer to check their e-mail, but remember that they might accidentally download some malicious program, or actually post or send something under your name. Usually these messages are funny or embarassing, but you haven't any control.
- Of course, if you have logged out from all of your applications, your friend won't be able to access your accounts, but they can still download malware to your computer.
- Run Anti-virus and anti-spyware software
- Not only should you run anti-virus software, but make sure you get updates on a regular basis. I usually run an update every morning, followed by a scan of my computer. Most computers come with anti-virus, but if you need a free program, try AVG Free.
- Most
people know about anti-virus, but not as many are aware of
anti-spyware software. This works similar to anti-virus, but it is
looking for programs that do things like track your web browsing. Here
are some free anti-spyware software that I have used:
- Spybot Search and Destroy
- Lavasoft Ad Aware
Facebook Dangers
- Personal Information
- Friends List
- Applications
Personal Information
Facebook
has some additional features that make it easier to expose your
information. For one thing, you are more likely to include personal
information on the web site. Be very careful because this can be used
for identify theft. You can also help burglars know when you are going
to be away from home for long periods of time ("I'm leaving tomorrow to
XXXX for a whole three weeks!"). I have heard (but not confirmed)
that someone had their place broken into after they mentioned going
away for a long weekend on facebook.
Depending on how much information you put into your profiles, you might be at risk for identity theft. All that is needed to identify a person is
their birthday, their sex, and their zip code. If you have your
birthday, address, and phone number, you are making it easy for somebody
to steal your identity. With that information, people can search
various on-line databases to uniquely identify a person. Since most
people on facebook use their actual names, that makes identity theft
even easier. Don't display your birth year. Just put the city name
instead of your actual address; if you live near a large city, then
enter that name instead of your actual town. And be careful what you
post on your wall. I've seen people put their actual address, their cell
phone number, when they were going to be away, etc. on their wall,
which is very dangerous.
Friends List
Some
people accept any friend request they get, whether they know the
person or not. This is a serious problem, since whoever you accept will
be able to see all your personal information. They can also see
personal information about your friends. So, even if you only accept
friends from people you know, if you have a friend that accepts
anybody's request, your personal information might be exposed. Make
sure your personal settings are restricted to "friends only", not
"friends of friends."
Debt
collectors have been known to find people who are behind in their
debts, send them a friend request, and then start to bother them. If
they can't conect to the person of interest, they try to friend their
friends. In one case, they friended the person's mother and told them
that failure to pay might end up in jail time. A few clever collectors
have their profile picture set to a cute young woman in order to get
men to accept their requests. (read more details)
Most
employers will search facebook, myspace, etc. to find out more about
people applying for a job. So having those embarassing pictures open
to the public might prevent you from landing your next job. Do you
want your future employer reading your smart aleck comments on your
wall?
You
can create several different friends lists, and then assign different
permissions to each list. This will allow you to accept a friend
request and still restrict what they can see. With this arrangement,
your close friends can see everything you have on Facebook, but your
business or casual friends will only see some basic information. You
can read more aboutmanaging friends lists.
Applications
Another
serious danger on facebook are all of the applications. Any
application that asks to access your profile information puts your
information at risk. What's worse, if any of your friends use those
applications, they also put your information at risk, even if you never
run an application. Supposedly, these applications only use this
feature to put the results and some cute picture on your home page, or
help you remember events, birthdays, etc. However, facebook doesn't
bother to check any of these applications. There is no rating system,
so that you have no idea if the application is safe or malicious.
The ACLU has highlighted these dangers recently by creating their own quiz,
which displays all the information that is available to the quiz. It
is important to realize that quizzes aren't created by facebook, but
by facebook users - any facebook user can create a quiz. Why
would you trust an anonymous programmer that you know nothing about
with not only your own personal information, but information about all
your friends? When you run a quiz, you give the application permission to access anything in your profile,including your friends' profiles.
A quiz can do anything you can do on facebook; actually, even more.
And no virus or malware scan will even see any of this, let alone
prevent it.
It
is important to realize that applications aren't affected by what
browser you run or what anti-virus or anti-malware software you run. The
damage isn't done on your machine, it is done on the facebook
servers. As soon as you run an application, you have given it
permission to do anything it wants to any and all of your information,
and any information you can see about your friends. And remember, the
people who write applications aren't hired by facebook, they are
anyone who wants to write an application.
What kind of problems can applications raise?
- Photo of the Day
- There was one application called Photo of the Day that actually sent your personal information to the author. This was built as part of a research project, and became quite popular, without people knowing that their information was being compromised.
- The Danger of Facebook Quizzes
- Many people seem to enjoy taking lots of quizzes on facebook. There are several problems with quizzes:
- Accuracy - does anyone actually believe those quizzes?
- Exposure - the authors have access to all your answers and your personal information
- Control - you are giving the application permission to do things in your name
- For example, the article The Danger of Facebook Quizzes gives examples of how quizzes have been used to sell personal information to drug and marketing companies, based on your answers. So if you mention you have trouble sleeping, you might start getting e-mail, junk mail, or even phone calls trying to sell you sleep products.
- One quiz asked the names of your pets, kids, spouse, etc. These are what many people use for their passwords. Even if you don't use them for passwords, the information you provide might be used by a malicious person to construct a message using social engineering that looks genuine, but isn't. For example, someone could send something to your friend and mention your brother John, or your dog fluffy, which can cause your friend to think they are talking to one of your friends.
- Facebook Fan Check (or Stalker Check)
- There are rumors going around that the Fan Check (which used to be known as stalkercheck) is a virus.
- I would like to remind people that any application that asks permission to access your profile puts your facebook account at risk (and the facebook accounts of all your friends as well.)
- However, what is going on might be something different. It might be a fake virus alert to trick you into infecting your computer.
- Here is how these kinds of things work:
- Somebody starts a rumor that something is actually a virus.
- They include a link to some site that supposedly "fixes" the virus.
- The link actually contains malware that will infect your computer.
- At this point, there is no proof that Fan Check / stalker check is a virus. I know of two friends who have used it, and neither have reported any problem.
- Remember, be *very careful* before installing anything on your computer. This shows how people can be tricked into downloading something to "fix" a problem they think they have, when they are actually infecting their computer with malware.
Any
time something asks permission to access your profile, I recommend
you say "no". Granted, you won't be able to take the lame quizzes, or
stick silly pictures on your page, but at the same time, you are less
likely to have your identity stolen or your account hacked. The choice
is yours.
Recovering After Being Hacked
Most
people know they should close the barn door after the horse got out,
but what should you do if your account has been hacked? For starters,
you should change your password. That may or may not prevent future
problems, but it can't hurt. If you used the same password (or a similar
password) for any other accounts, make sure you change those as well.
The
next thing you want to do it try to figure out how your account got
hacked. If you have run a new application, maybe you want to block it.
Of course, clever authors of malicious software won't do anything at
first, and wait a while before doing anything bad. That makes it more
difficult to identify the source of the problem. If you don't really
need some application, get rid of it. Better safe than sorry.
Notify
your friends. If your account has been hacked, your friends are in
danger of being hacked as well. If you know the cause, warn them not to
click on the application, message, etc.
Check
your account settings, especially all of your security settings.
Malicious software often tries to spread as much as possible. By letting
all people view your information, it will increase the chances that
somebody else might get infected with whatever trashed your account.
.jpg)
