Phishers harvest Facebook passwords for profit

Thieves assume people use the same password for most online identities

Identity thieves that hit Facebook last week with a new round of phishing attacks are harvesting passwords for profit, a security researcher said today.

"It's not surprising that they're targeting Facebook," said Kevin Haley, a director on Symantec's security response team. "Facebook has, what, 200 million-plus users? The bad guys always go where's there's a lot of people."

The newest Facebook attacks resemble previous phishing rounds in their tactics: A compromised account sends a malicious link to friends. That link leads to a site that mimics the legitimate log-in page. But users duped into entering their usernames and passwords are likely giving away more than just their Facebook credentials, said Haley.

"Certainly this isn't new," he said, "but we think that what you're seeing is an attempt to shake out every last dollar they can get."

The criminals are operating on the assumption that the Facebook password they acquire from any given user has a good chance of being the same password that person uses on other sites, such as online shopping services or even bank accounts.

"Get one password for the right person and it's like having their wallet handed over," Symantec researcher Marian Merritt in the post to Symantec's security response blog said on Friday.

Although Symantec has no statistics on the percentage of users who rely on just a single password for multiple online services or activities -- Haley called the evidence "anecdotal" -- it's an assumption that both criminals and researchers make. "When you talk to users, that's what they tell you they do," he said.

Facebook has acknowledged the attack, and said it has reset passwords of compromised accounts and eliminated the phishing messages when it has found them.

"It's not like this is some great new virus technology," Haley said, noting that the newest attacks are unlike worm-based attempts to infect Facebook accounts with the Koobface worm. This is straight con job. "Cons have been known from the beginning of time," Haley continued. "But now we're seeing them coming a little faster and more furious."

The problem with social sites like Facebook is that they portray a certain level of trust -- others are "friends," after all, Haley added -- and while users' may be wary of clicking on links delivered via traditional e-mail, they haven't yet made the same connection to social networking.

"People are very wary of e-mail [phishing attacks]. They've begun to catch on," said Haley. "But they don't have their antenna up when it comes to social networking."

Symantec's Merritt urged users to use more caution before clicking on links, to double-check the site's URL and to use more, and more complex, passwords.

But Haley is pessimistic that the advice would sink in anytime soon. "It's a progression," he said, referring to the learning curve users go through before they realize they need to take care of their identities in a new online technology or type of service.

Even then, it's a never-ending fight. "If there's a way to figure out a new way to attack, the bad guys will do it," Haley concluded.

Join the newsletter!

Error: Please check your email address.
Rocket to Success - Your 10 Tips for Smarter ERP System Selection

Tags phishingFacebook

Keep up with the latest tech news, reviews and previews by subscribing to the Good Gear Guide newsletter.

Gregg Keizer

Computerworld
Show Comments

Most Popular Reviews

Latest Articles

Resources

PCW Evaluation Team

Sarah Ieroianni

Brother QL-820NWB Professional Label Printer

The print quality also does not disappoint, it’s clear, bold, doesn’t smudge and the text is perfectly sized.

Ratchada Dunn

Sharp PN-40TC1 Huddle Board

The Huddle Board’s built in program; Sharp Touch Viewing software allows us to easily manipulate and edit our documents (jpegs and PDFs) all at the same time on the dashboard.

George Khoury

Sharp PN-40TC1 Huddle Board

The biggest perks for me would be that it comes with easy to use and comprehensive programs that make the collaboration process a whole lot more intuitive and organic

David Coyle

Brother PocketJet PJ-773 A4 Portable Thermal Printer

I rate the printer as a 5 out of 5 stars as it has been able to fit seamlessly into my busy and mobile lifestyle.

Kurt Hegetschweiler

Brother PocketJet PJ-773 A4 Portable Thermal Printer

It’s perfect for mobile workers. Just take it out — it’s small enough to sit anywhere — turn it on, load a sheet of paper, and start printing.

Matthew Stivala

HP OfficeJet 250 Mobile Printer

The HP OfficeJet 250 Mobile Printer is a great device that fits perfectly into my fast paced and mobile lifestyle. My first impression of the printer itself was how incredibly compact and sleek the device was.

Featured Content

Latest Jobs

Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?