Personal Security on Social Networking Sites

This articles originally is posted on: www.securityorb.com

Personal Security on Social Networking Sites
By
Kellep A. Charles, CISA, CISSP
kellep_charles@yahoo.com

Visits to social networking sites account for more than 10% of the total time people spend on the Internet, according Nielsen Online. A social network site focuses on building online communities of people who share common interests and activities, such as Linkedin.com and Facebook.com. Facebook is now the most visited social networking site on the Internet, with nearly 1.2 billion visits in January 2009 alone, while Twitter and Linkedin are steadily gaining ground.

Hackers have adopted the popularity of social networking sites into their malicious plans to compromise systems and steal personal identifiable information. Recent attacks such as the Koobface virus on Facebook and the clickjacking issues faced by Twitter are all prime examples of the recent challenges. Also, these very same hackers have the capability to remain anonymous on these social networking sites, which enforces the notion, you really do not know who is on the Internet with you.

Security on social networking sites are at a minimal standard right now, they rely on usernames and passwords for authentication and security, which means that anyone who finds out your username and password can gain access to your account. Until social networking site security evolves with time and improves, users need to be very careful and diligent.

Here are a few tips that should assist in making sure you are safe when using social networking sites:

1. Understand how the social networking site displays your information. Some sites will allow the user to control who can see your information, while others will allow anyone and everyone to view postings.

2. Don't click on shortened (or "condensed") URL's, like those created by TinyURL and Bit.ly. There's no telling where these links lead to, and that makes it easy to funnel you to malicious websites (Drive-by-Download).

3. Be mindful of your personal information such as, don't post your full name, address, age, hometown or information about your family. Even your screen name can pose a lot of identifiable information.

4. Post appropriate information that are comfortable with others seeing and knowing, such as your employer, co-workers and acquaints. Many people will see your page or postings, including the people who will be interviewing you for a current position or a future job.

5. Remember that once you post information online, it may be impossible to take it back. This includes photos that can be manipulated.

6. Be careful when it comes to online personal socializations such as flirting or disputes. Some people lie about whom they are. Be wary if a new online friend wants to meet you in person.

7. Trust your instincts if you have suspicions. If you feel threatened by someone or uncomfortable because of something online, report it to the police and to the operators of the social networking site. You could end up preventing someone else from becoming a victim.

Social networking sites are evolving into our personal and business lives. People from various stages and walks of life are participating in these events with very little knowledge into the dangers of these social networking sites. The site owners only provide the minimal required security measures, while hackers are using tactics that has shown great success in circumventing them. It is up to us, to do what is necessary to protect ourselves until better security measures are implemented or the hackers give up. Don’t hold your breath on the hacker’s giving up.

For more information on this article and other informative articles go to: www.securityorb.com

Microsoft Internet Explorer Cookie Path Attribute Vulnerability

Microsoft Internet Explorer Cookie Path Attribute Vulnerability

Date of Discovery: 17.11.2004
Criticality: Critical
Affects: Microsoft Internet Explorer 6.x

Compromise From: From remote
Compromise Type: Hijacking

Summary
A vulnerability has been reported in Internet Explorer, which potentially can be exploited by malicious people to conduct session fixation attacks.

Detailed Description
A vulnerability has been reported in Internet Explorer, which potentially can be exploited by malicious people to conduct session fixation attacks.

The vulnerability is caused due to a validation error in the handling of the path attribute when accepting cookies. This can potentially be exploited by a malicious website, if the trusted site supports wildcard domains or the domain name contains the malicious sites domain, using a specially crafted path attribute to overwrite cookies for the trusted site.

The vulnerability has been reported in Internet Explorer 6.0 SP1 on Microsoft Windows XP SP1. Microsoft Windows XP SP2 is reportedly not affected.

Note: Successful exploitation also requires that the trusted site handles cookies and authentication in an inappropriate or insecure manner.

Solution
Update to Windows XP SP2.

Disable cookies except when needed.

CVE Reference
CVE-2004-1527

Apple's Mac Isn't as Secure as Some Want Us to Believe

An interesting article on eweek.com

Source: http://www.eweek.com/c/a/Security/Apples-Mac-Isnt-as-Secure-as-Some-Want-Us-to-Believe-183583/

SecurityOrb.com News Updates

1. Mass-compromise attack injects malware into pages and redirects victims to a site that then downloads Trojans and keylogger code

Source: http://www.infoworld.com/d/security-central/nine-ball-attack-strikes-40000-web-sites-882?source=rss_security_central


2. Google is testing using HTTPS by default on all Gmail pages, though the move would likely inhibit performance

Source: http://www.infoworld.com/d/applications/google-try-more-security-gmail-860?source=rss_security_central


3. Researchers at Finjan outlined a sophisticated one-stop show for cyber-criminals buying and trading in infected computers. Called Golden Cash, the network has been linked to the compromises of around 100,000 PCs and FTP credentials.

Source: http://www.eweek.com/c/a/Security/Finjan-Researchers-Uncover-Marketplace-for-Botnets-595200/

Mac4Lin Gives Linux Desktops the Complete Mac Look

Linux: Mac4Lin, a package of skins, wallpapers, icons, and interface refinements that brings a completist Mac look to Linux with an automated installation, has reached the 1.0 stage with an impressive array of features.

Besides basic theming changes to your desktop covering login windows, window look and feel, a modified app launcher dock, and more, Mac4Lin plugs into and plays nice with a lot of third-party apps. Thunderbird, Rhythmbox, Songbird, Pidgin, Firefox 3, and others are supported and receive theme integrations, while a customized Cairo or AWN dock are rolled into your system during the installation.

It goes without saying, but there are, obviously, areas where the Linux desktop can't replicate the Mac's. Still, if you like the Cupertino look for your system, Mac4Lin is an easy way to get there, without an afternoon-consuming step-by-step process.

Mac4Lin 1.0 is a free download for Linux systems. Hit the link below for a list of features, standing bugs, and screenshots.

Mac4Lin ver.1.0 Released! [via Peng Hardin]

Source: http://lifehacker.com/5290955/mac4lin-gives-linux-desktops-the-complete-mac-look

Hacker Halted USA Conference to Offer Complimentary Security Training worth $599 to All Delegates

Hacker Halted USA Conference to Offer Complimentary Security Training worth $599 to All Delegates

Unique opportunity for attendees of information security conference in Miami to attend specially designed one-day training workshops covering some of the most popular security topics.

Attendees of Hacker Halted USA 2009, a world-class information security conference to be hosted in Miami, Florida, from September 23 – 25, will be entitled to attend one of three security workshops led by EC-Council Master Instructors. These one-day workshops will cover three of the most popular security topics, namely Identifying Threats and Deploying Countermeasures; Principles of Incident Handling; and Exposing Virtualization Security Threats. Read More.....

Link: http://www.hackerhalted.com/NewsCenter/HackerHaltedUpdates/BreakingNewsJune10/tabid/167/Default.aspx

Microsoft Zero-Day DirectX Flaw

Vulnerability Details

Microsoft has reported a critical new vulnerability in Microsoft DirectX affecting older versions of Windows. The vulnerability could allow remote code execution if a user opens a rogue QuickTime media file. Microsoft reports limited, active attacks that use this exploit code.

The vulnerability exists in the way a DirectX application programming interface known as DirectShow handles supported QuickTime files. By manipulating the format, attackers can gain the same system privileges assigned to the logged-in user. The Microsoft Security Advisory states: “If a user is logged on with administrative user rights, an attacker who successfully exploited this vulnerability could take complete control of an affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.”

Affected Software

• Windows 2000 Service Pack 4
• Windows XP
• Windows Server 2003

All versions of Windows Vista, Windows Server 2008, and the beta version of Windows 7 are NOT vulnerable. In addition, Apple’s Quick Time player is NOT affected.

Please consult the official Microsoft Security Advisory for details on workarounds, fixes and patch availability.

Workaround

Microsoft has issued a workaround that disables the automatic QuickTime parsing on machines running Window 2000, Windows XP or Windows Server 2003.

Recommendations

Keep your anti-virus products up-to-date with the current pattern files.