Social Engineering On Social Sites

The same rules that apply to regular web surfing and email, i.e. don’t open strange attachments, don’t go to strange sites, don’t click on unexpected links — also apply to the social networking sites you use.

I came across an article (link here) about malware that is spreading via Facebook and MySpace. Nothing new here. I’ve also heard “grumblings” about the security community about these sites not always taking decisive actions to protect their users. Perhaps their perspective is one of usability, i.e. they prefer to focus on making things available and accessible, and a switch to a focus on security might hinder this goal. But whatever their reason (and it is their network and they are entitled to run it as they please, to a certain extent), it’s up to YOU to ensure that you use these tools safely.

Another article I came across (link here) talks about somebody on Twitter who has created a profile with only a picture. If you click on the picture, you’ll be sent to a site that attempts to infect your computer with malware. Again, if you don’t know the person, don’t click on the link (I’d go so far as to say to not click on a link even if you know the person, but that may be a bit too much; you have to decide. After all, you trust me to give you good links…).

In general, be careful when you surf. And two more quick tips:

1. Separate business and pleasure. If you want to surf the Internet for recreational use, get a second computer and use it. I’d even go so far as to recommend that you do your business surfing from this second computer (although there are other considerations, such as taxes and business write-offs, that should be considered). You can usually find inexpensive laptops for around $500 and desktops for even less.

2. Create a user account that does not have administrative rights and use that account to surf. Most default accounts (which are what people use — by default) have admin rights. Creating and using a regular user account for surfing can help protect your computer.

Of course, you should also use good anti virus software, anti spyware software, a good software and hardware firewall, and “just be smart”. It’s your business (whatever that “business” is) — protect it.

–Tom