Phishers harvest Facebook passwords for profit

Thieves assume people use the same password for most online identities

Identity thieves that hit Facebook last week with a new round of phishing attacks are harvesting passwords for profit, a security researcher said today.

"It's not surprising that they're targeting Facebook," said Kevin Haley, a director on Symantec's security response team. "Facebook has, what, 200 million-plus users? The bad guys always go where's there's a lot of people."

The newest Facebook attacks resemble previous phishing rounds in their tactics: A compromised account sends a malicious link to friends. That link leads to a site that mimics the legitimate log-in page. But users duped into entering their usernames and passwords are likely giving away more than just their Facebook credentials, said Haley.

"Certainly this isn't new," he said, "but we think that what you're seeing is an attempt to shake out every last dollar they can get."

The criminals are operating on the assumption that the Facebook password they acquire from any given user has a good chance of being the same password that person uses on other sites, such as online shopping services or even bank accounts.

"Get one password for the right person and it's like having their wallet handed over," Symantec researcher Marian Merritt in the post to Symantec's security response blog said on Friday.

Although Symantec has no statistics on the percentage of users who rely on just a single password for multiple online services or activities -- Haley called the evidence "anecdotal" -- it's an assumption that both criminals and researchers make. "When you talk to users, that's what they tell you they do," he said.

Facebook has acknowledged the attack, and said it has reset passwords of compromised accounts and eliminated the phishing messages when it has found them.

"It's not like this is some great new virus technology," Haley said, noting that the newest attacks are unlike worm-based attempts to infect Facebook accounts with the Koobface worm. This is straight con job. "Cons have been known from the beginning of time," Haley continued. "But now we're seeing them coming a little faster and more furious."

The problem with social sites like Facebook is that they portray a certain level of trust -- others are "friends," after all, Haley added -- and while users' may be wary of clicking on links delivered via traditional e-mail, they haven't yet made the same connection to social networking.

"People are very wary of e-mail [phishing attacks]. They've begun to catch on," said Haley. "But they don't have their antenna up when it comes to social networking."

Symantec's Merritt urged users to use more caution before clicking on links, to double-check the site's URL and to use more, and more complex, passwords.

But Haley is pessimistic that the advice would sink in anytime soon. "It's a progression," he said, referring to the learning curve users go through before they realize they need to take care of their identities in a new online technology or type of service.

Even then, it's a never-ending fight. "If there's a way to figure out a new way to attack, the bad guys will do it," Haley concluded.

Join the PC World newsletter!

Error: Please check your email address.

Tags phishingFacebook

Our Back to Business guide highlights the best products for you to boost your productivity at home, on the road, at the office, or in the classroom.

Keep up with the latest tech news, reviews and previews by subscribing to the Good Gear Guide newsletter.

Gregg Keizer

Show Comments


Microsoft L5V-00027 Sculpt Ergonomic Keyboard Desktop

Learn more >

Lexar® JumpDrive® S57 USB 3.0 flash drive

Learn more >


Lexar® JumpDrive® S45 USB 3.0 flash drive 

Learn more >


Audio-Technica ATH-ANC70 Noise Cancelling Headphones

Learn more >

Lexar® JumpDrive® C20c USB Type-C flash drive 

Learn more >

HD Pan/Tilt Wi-Fi Camera with Night Vision NC450

Learn more >

Lexar® Professional 1800x microSDHC™/microSDXC™ UHS-II cards 

Learn more >


Back To Business Guide

Click for more ›

Most Popular Reviews

Latest News Articles


GGG Evaluation Team

Kathy Cassidy


First impression on unpacking the Q702 test unit was the solid feel and clean, minimalist styling.

Anthony Grifoni


For work use, Microsoft Word and Excel programs pre-installed on the device are adequate for preparing short documents.

Steph Mundell


The Fujitsu LifeBook UH574 allowed for great mobility without being obnoxiously heavy or clunky. Its twelve hours of battery life did not disappoint.

Andrew Mitsi


The screen was particularly good. It is bright and visible from most angles, however heat is an issue, particularly around the Windows button on the front, and on the back where the battery housing is located.

Simon Harriott


My first impression after unboxing the Q702 is that it is a nice looking unit. Styling is somewhat minimalist but very effective. The tablet part, once detached, has a nice weight, and no buttons or switches are located in awkward or intrusive positions.

Featured Content

Latest Jobs

Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?