IT security, vunerabilities, bugs, fixes, flaws, RSA conference and Infosec.
A blog from V3.co.uk

« Webroot says that Web 2.0 terrifies businesses | Main | Twitter attacks snare senior politicians »

What to do when your social networking account gets hacked

Security-as-a-service firm ScanSafe, now part of the Cisco fold, has decided to share some advice on what users should do if they fall victim to a phishing scam pushed out via social networking sites.

Phishing scams are becoming increasingly popular via social networking sites, as they try to tap the implicit trust users have in their friends' or followers' messages.

By hacking users' accounts, sending out messages to their friends and using social engineering techniques to get them to click on malicious links in these messages, cyber criminals have been able to harvest a rich bounty of user credentials - many of which can then be exploited on other sites such as online banking.

According to ScanSafe senior security researcher Mary Landesman, there should be an ABC of proper etiquette after suffering one of these scams: acknowledge the attack to anyone affected; be detailed in telling them what might have happened as a result; use the attack as an opportunity to caution friends/followers in case it happens again.

If sending out an apology to their followers after their account has been hacked and malicious messages sent out, users should never stick another link in the message, she advised.

"Using as few words as possible, try to include enough details about the message sent so folks can identify it, ended with a brief 'I'm sorry'," said Landesman.

Another best practice tip Landesman gave was that when sending legitimate links, users steer clear of generic messages, which are usually used by cyber criminals.

"Get in the habit of including some identifying info so that the recipient can tell that the human you really did intend to send it," she said. "For example, instead of sending 'check out this funny video', always include more specifics like, 'funny video - reminds me of that crazy guy we saw on the beach in the Bahamas.'

"If enough folks adopted this habit, it would become much easier to distinguish the really generic messages as being likely phishing/malware attacks."

All good advice, although some stronger content filtering technology from the likes of Twitter would also help matters no doubt.

February 23, 2010 |

Comments

Post a comment







Site credentials: About | Privacy policy | Terms & conditions | Top of the page
© Incisive Media Investments Limited 2010, Published by Incisive Financial Publishing Limited, Haymarket House, 28-29 Haymarket, London SW1Y 4RX, are companies registered in England and Wales with company registration numbers 04252091 & 04252093