{"id":5410,"date":"2017-11-09T14:09:19","date_gmt":"2017-11-09T14:09:19","guid":{"rendered":"https:\/\/www.n-able.com\/?p=5410"},"modified":"2021-04-06T14:11:29","modified_gmt":"2021-04-06T13:11:29","slug":"security-weak-points-social-media","status":"publish","type":"post","link":"https:\/\/www.n-able.com\/de\/blog\/security-weak-points-social-media","title":{"rendered":"Security Weak Points: Social Media"},"content":{"rendered":"

Surveying participants at the annual RSA security conference in San Francisco earlier this year, one vendor put some numbers to the social media security risk. The \u201cEmployee Social Network Password Practices a Major Workplace Risk\u201d\u00a0report<\/a>\u00a0found that 50% of those questioned hadn’t changed social network passwords for at least a year, and 20% had never changed them. But the most shocking thing is that the survey was of security professionals; if they are that slack with social media security issues, just imagine what your average user is like.<\/p>\n

The Social Media Security Problem<\/b><\/h3>\n

\"too_social_banner.jpg\"Unfortunately, all too often, users of social media put too much emphasis on the ’social‘ bit and don’t even consider the risk that social networking brings to a business. Across the big four networks\u2014Facebook\u00ae<\/sup>, Twitter\u00ae<\/sup>, LinkedIn\u00ae<\/sup>\u00a0and Instagram\u00ae<\/sup>\u2014security vendor Proofpoint\u00a0reports<\/a>\u00a0a 150% rise in social engineering last year alone. The truth is that social media\u00a0‚brand fraud‘<\/a>\u00a0is rife, with scammers defrauding those who think they are dealing with a genuine business.<\/p>\n

This kind of phishing expedition is remarkably easy to pull off in the relaxed environment of the social network, where normal security skepticism seems to get put on hold. Typically, a fraudster will establish a likely sounding, but fake, customer support account for a well-known brand. By monitoring the real support accounts online, usually in the evening or at weekends when genuine support is likely to be much slower to respond, the fraudsters can then reach out to customers using the fake accounts. At which point, user credentials can be obtained in the name of, ironically, security safeguards. Not only are individuals put at risk, but so are the businesses behind the brands as reputational damage can be hard to contain once word starts spreading.<\/p>\n

More Social Security Issues<\/b><\/h3>\n

Human error is always an easy out when playing the blame game, but blame culture is to be avoided at all costs. Instead, educate users not to trust everyone within their social circle online and not to take messages and links at face value. The best way to do this is through example: relate how ransomware such as Locky encrypted files by embedding the malware code in image files on social networks. Using compromised accounts to leverage the trust factor of ‚Facebook friends‘ the threat actors were able to post these images, and when a user clicked on them it would download and install Locky in the background.<\/p>\n

Not all threats require an account to be compromised though, some targeted ’spear phishing‘ attacks will look to see who someone in a particular business communicates with socially online. They will then send friend requests to all those people, before eventually sending one to the real target. Because the threat actor appears to be a ‚friend of a friend‘ to even one or two people already in the social circle of the victim, they are more likely to accept the request. Then the social engineering can really start, usually in order to reveal credentials to enable them to breach the business network.<\/p>\n

Facebook Security Issues<\/b><\/h3>\n

\"credentials.jpg\"Games, surveys and the like should always be on the ’not allowed‘ list. These are a favorite amongst the Facebook credential harvesting threat actors. Usually they involve entering credentials supposedly to enable the data for the survey to be gathered, or the results to be shared, and while they may well do that the risk is that they can also be skimmed by the bad guys in order to compromise your account. That’s without even mentioning the risk of obfuscated JavaScript\u00ae<\/sup>\u00a0being installed on your computer to act as a malware installation conduit.<\/p>\n

Likejacking<\/a>\u00a0has hit plague proportions on Facebook (along with Instagram), although user interface redressing or IFRAME overlaying is a more accurate description. This involves malicious code hiding under what appears to be a legitimate ‚like‘ button. It’s also known as clickjacking where other content is used to obfuscate the intention. One click can initiate a malware download, or magic the user off to a site that exists purely for credential scraping purposes.<\/p>\n

Twitter Security<\/b><\/h3>\n

All of the above pretty much applies to Twitter as well, although it does have a more unique twist on some security issues. So while Twitter does suffer from the link-clicking curse, more often this will take the form of a shortened URL taking the clicker to a dangerous site. This makes perfect sense given the character count limitations of Twitter. Twitter has responded to this by shortening all links using a proprietary ‚t.co‘ service and displaying a warning if a link is going to a known or potentially dangerous site. However, it’s still possible that URL redirection can be used to jump from a ’safe‘ landing point to an unsafe one.<\/p>\n

LinkedIn Security<\/b><\/h3>\n

You may think that the business-oriented networks wouldn’t suffer from security threats. But LinkedIn certainly does, not least as it’s a depository for valuable business information that can then be used to launch targeted social engineering attacks. Users should be very careful about accepting LinkedIn contact requests from people they do not know or where the business link is tenuous at best. Indeed, some LinkedIn invitation reminder messages have been known to be employed as URL redirectors to malware loading pages.<\/p>\n

Securing Social Media<\/b><\/h3>\n

\"rogueaccounts_banner.jpg\"Organizations need to be on the ball by actively tracking their brand across social networks. If they find fake accounts, they can be reported and quickly taken down and the threat aborted. Official accounts can be used to give warnings to customers as to how to spot the fakes, and so bolster a reputation for taking security seriously.<\/p>\n

Limiting publishing rights for users of your social media channels also makes good sense. It should be thought of no differently to admin credentials for your business network; you wouldn’t give that sort of\u00a0privileged access<\/a>\u00a0to every member of staff, and neither should you allow just any staff member to post messages to your social networks.<\/p>\n

But perhaps the best advice I can give regarding a robust defense against the social media security threat is to engage in a regular process of connection curating. The more ‚friends‘ you have, the bigger your exposure to risk. Do this as part of a broader social media policy, and you should have most of the risk mitigation bases covered.<\/p>\n

Davey has been writing about IT security for more than two decades, and is a three-time winner of the BT Information Security Journalist of the Year title. An ex-hacker turned security consultant and journalist, Davey was given the prestigious ‚Enigma‘ award for his ‚lifetime contribution‘ to information security journalism in 2011.\u00a0\u00a0You can follow Davey on Twitter\u00a0at\u00a0@happygeek<\/a><\/em><\/p>\n

\u00a9 2017 SolarWinds MSP UK Ltd. All Rights Reserved.<\/p>\n","protected":false},"excerpt":{"rendered":"

Surveying participants at the annual RSA security conference in San Francisco earlier this year, one vendor put some numbers to the social media security risk. The \u201cEmployee Social Network Password…<\/p>\n","protected":false},"author":24,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"inline_featured_image":false,"footnotes":""},"class_list":["post-5410","post","type-post","status-publish","format-standard","hentry","topic-security"],"acf":[],"yoast_head":"\nSecurity Weak Points: Social Media - N-able<\/title>\n<meta name=\"description\" content=\"While companies look to social networks as a way to engage customers, Davey Winder warns that there are major security concerns to consider as well.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.n-able.com\/de\/blog\/security-weak-points-social-media\" \/>\n<meta property=\"og:locale\" content=\"de_DE\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Security Weak Points: Social Media - N-able\" \/>\n<meta property=\"og:description\" content=\"While companies look to social networks as a way to engage customers, Davey Winder warns that there are major security concerns to consider as well.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.n-able.com\/de\/blog\/security-weak-points-social-media\" \/>\n<meta property=\"og:site_name\" content=\"N-able\" \/>\n<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/NableMSP\" \/>\n<meta property=\"article:published_time\" content=\"2017-11-09T14:09:19+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2021-04-06T13:11:29+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/www.n-able.com\/wp-content\/uploads\/blog\/2017\/11\/too_social_banner.jpg\" \/>\n<meta name=\"author\" content=\"N-able\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@Nable\" \/>\n<meta name=\"twitter:site\" content=\"@Nable\" \/>\n<meta name=\"twitter:label1\" content=\"Verfasst von\" \/>\n\t<meta name=\"twitter:data1\" content=\"N-able\" \/>\n\t<meta name=\"twitter:label2\" content=\"Gesch\u00e4tzte Lesezeit\" \/>\n\t<meta name=\"twitter:data2\" content=\"6\u00a0Minuten\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\/\/www.n-able.com\/de\/blog\/security-weak-points-social-media#article\",\"isPartOf\":{\"@id\":\"https:\/\/www.n-able.com\/de\/blog\/security-weak-points-social-media\"},\"author\":{\"name\":\"N-able\",\"@id\":\"https:\/\/www.n-able.com\/de#\/schema\/person\/f46a000e389b6d02bd4b3866e7828a7b\"},\"headline\":\"Security Weak Points: Social Media\",\"datePublished\":\"2017-11-09T14:09:19+00:00\",\"dateModified\":\"2021-04-06T13:11:29+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\/\/www.n-able.com\/de\/blog\/security-weak-points-social-media\"},\"wordCount\":1127,\"publisher\":{\"@id\":\"https:\/\/www.n-able.com\/de#organization\"},\"image\":{\"@id\":\"https:\/\/www.n-able.com\/de\/blog\/security-weak-points-social-media#primaryimage\"},\"thumbnailUrl\":\"https:\/\/www.n-able.com\/wp-content\/uploads\/blog\/2017\/11\/too_social_banner.jpg\",\"articleSection\":[\"Security\"],\"inLanguage\":\"de\"},{\"@type\":\"WebPage\",\"@id\":\"https:\/\/www.n-able.com\/de\/blog\/security-weak-points-social-media\",\"url\":\"https:\/\/www.n-able.com\/de\/blog\/security-weak-points-social-media\",\"name\":\"Security Weak Points: Social Media - N-able\",\"isPartOf\":{\"@id\":\"https:\/\/www.n-able.com\/de#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\/\/www.n-able.com\/de\/blog\/security-weak-points-social-media#primaryimage\"},\"image\":{\"@id\":\"https:\/\/www.n-able.com\/de\/blog\/security-weak-points-social-media#primaryimage\"},\"thumbnailUrl\":\"https:\/\/www.n-able.com\/wp-content\/uploads\/blog\/2017\/11\/too_social_banner.jpg\",\"datePublished\":\"2017-11-09T14:09:19+00:00\",\"dateModified\":\"2021-04-06T13:11:29+00:00\",\"description\":\"While companies look to social networks as a way to engage customers, Davey Winder warns that there are major security concerns to consider as well.\",\"breadcrumb\":{\"@id\":\"https:\/\/www.n-able.com\/de\/blog\/security-weak-points-social-media#breadcrumb\"},\"inLanguage\":\"de\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/www.n-able.com\/de\/blog\/security-weak-points-social-media\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"de\",\"@id\":\"https:\/\/www.n-able.com\/de\/blog\/security-weak-points-social-media#primaryimage\",\"url\":\"https:\/\/www.n-able.com\/wp-content\/uploads\/blog\/2017\/11\/too_social_banner.jpg\",\"contentUrl\":\"https:\/\/www.n-able.com\/wp-content\/uploads\/blog\/2017\/11\/too_social_banner.jpg\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/www.n-able.com\/de\/blog\/security-weak-points-social-media#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Security\",\"item\":\"https:\/\/www.n-able.com\/de\/blog\/category\/security\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Security Weak Points: Social Media\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/www.n-able.com\/de#website\",\"url\":\"https:\/\/www.n-able.com\/de\",\"name\":\"N-able\",\"description\":\"\",\"publisher\":{\"@id\":\"https:\/\/www.n-able.com\/de#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/www.n-able.com\/de?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"de\"},{\"@type\":\"Organization\",\"@id\":\"https:\/\/www.n-able.com\/de#organization\",\"name\":\"N-able\",\"url\":\"https:\/\/www.n-able.com\/de\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"de\",\"@id\":\"https:\/\/www.n-able.com\/de#\/schema\/logo\/image\/\",\"url\":\"https:\/\/www.n-able.com\/wp-content\/uploads\/2021\/02\/logo-n-able-vertical-dark.svg\",\"contentUrl\":\"https:\/\/www.n-able.com\/wp-content\/uploads\/2021\/02\/logo-n-able-vertical-dark.svg\",\"width\":\"1024\",\"height\":\"1024\",\"caption\":\"N-able\"},\"image\":{\"@id\":\"https:\/\/www.n-able.com\/de#\/schema\/logo\/image\/\"},\"sameAs\":[\"https:\/\/www.facebook.com\/NableMSP\",\"https:\/\/x.com\/Nable\",\"https:\/\/www.linkedin.com\/company\/n-able\",\"https:\/\/www.youtube.com\/channel\/UClnp77HHg4aME-S-3fWQhFw\"]},{\"@type\":\"Person\",\"@id\":\"https:\/\/www.n-able.com\/de#\/schema\/person\/f46a000e389b6d02bd4b3866e7828a7b\",\"name\":\"N-able\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"de\",\"@id\":\"https:\/\/secure.gravatar.com\/avatar\/e9c468b7c98137ecdd5508befa660c205a7978133257080a37fb0b1362d53411?s=96&d=mm&r=g\",\"url\":\"https:\/\/secure.gravatar.com\/avatar\/e9c468b7c98137ecdd5508befa660c205a7978133257080a37fb0b1362d53411?s=96&d=mm&r=g\",\"contentUrl\":\"https:\/\/secure.gravatar.com\/avatar\/e9c468b7c98137ecdd5508befa660c205a7978133257080a37fb0b1362d53411?s=96&d=mm&r=g\",\"caption\":\"N-able\"}}]}<\/script>\n<!-- \/ Yoast SEO Premium plugin. -->","yoast_head_json":{"title":"Security Weak Points: Social Media - N-able","description":"While companies look to social networks as a way to engage customers, Davey Winder warns that there are major security concerns to consider as well.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.n-able.com\/de\/blog\/security-weak-points-social-media","og_locale":"de_DE","og_type":"article","og_title":"Security Weak Points: Social Media - N-able","og_description":"While companies look to social networks as a way to engage customers, Davey Winder warns that there are major security concerns to consider as well.","og_url":"https:\/\/www.n-able.com\/de\/blog\/security-weak-points-social-media","og_site_name":"N-able","article_publisher":"https:\/\/www.facebook.com\/NableMSP","article_published_time":"2017-11-09T14:09:19+00:00","article_modified_time":"2021-04-06T13:11:29+00:00","og_image":[{"url":"https:\/\/www.n-able.com\/wp-content\/uploads\/blog\/2017\/11\/too_social_banner.jpg","type":"","width":"","height":""}],"author":"N-able","twitter_card":"summary_large_image","twitter_creator":"@Nable","twitter_site":"@Nable","twitter_misc":{"Verfasst von":"N-able","Gesch\u00e4tzte Lesezeit":"6\u00a0Minuten"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/www.n-able.com\/de\/blog\/security-weak-points-social-media#article","isPartOf":{"@id":"https:\/\/www.n-able.com\/de\/blog\/security-weak-points-social-media"},"author":{"name":"N-able","@id":"https:\/\/www.n-able.com\/de#\/schema\/person\/f46a000e389b6d02bd4b3866e7828a7b"},"headline":"Security Weak Points: Social Media","datePublished":"2017-11-09T14:09:19+00:00","dateModified":"2021-04-06T13:11:29+00:00","mainEntityOfPage":{"@id":"https:\/\/www.n-able.com\/de\/blog\/security-weak-points-social-media"},"wordCount":1127,"publisher":{"@id":"https:\/\/www.n-able.com\/de#organization"},"image":{"@id":"https:\/\/www.n-able.com\/de\/blog\/security-weak-points-social-media#primaryimage"},"thumbnailUrl":"https:\/\/www.n-able.com\/wp-content\/uploads\/blog\/2017\/11\/too_social_banner.jpg","articleSection":["Security"],"inLanguage":"de"},{"@type":"WebPage","@id":"https:\/\/www.n-able.com\/de\/blog\/security-weak-points-social-media","url":"https:\/\/www.n-able.com\/de\/blog\/security-weak-points-social-media","name":"Security Weak Points: Social Media - N-able","isPartOf":{"@id":"https:\/\/www.n-able.com\/de#website"},"primaryImageOfPage":{"@id":"https:\/\/www.n-able.com\/de\/blog\/security-weak-points-social-media#primaryimage"},"image":{"@id":"https:\/\/www.n-able.com\/de\/blog\/security-weak-points-social-media#primaryimage"},"thumbnailUrl":"https:\/\/www.n-able.com\/wp-content\/uploads\/blog\/2017\/11\/too_social_banner.jpg","datePublished":"2017-11-09T14:09:19+00:00","dateModified":"2021-04-06T13:11:29+00:00","description":"While companies look to social networks as a way to engage customers, Davey Winder warns that there are major security concerns to consider as well.","breadcrumb":{"@id":"https:\/\/www.n-able.com\/de\/blog\/security-weak-points-social-media#breadcrumb"},"inLanguage":"de","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.n-able.com\/de\/blog\/security-weak-points-social-media"]}]},{"@type":"ImageObject","inLanguage":"de","@id":"https:\/\/www.n-able.com\/de\/blog\/security-weak-points-social-media#primaryimage","url":"https:\/\/www.n-able.com\/wp-content\/uploads\/blog\/2017\/11\/too_social_banner.jpg","contentUrl":"https:\/\/www.n-able.com\/wp-content\/uploads\/blog\/2017\/11\/too_social_banner.jpg"},{"@type":"BreadcrumbList","@id":"https:\/\/www.n-able.com\/de\/blog\/security-weak-points-social-media#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Security","item":"https:\/\/www.n-able.com\/de\/blog\/category\/security"},{"@type":"ListItem","position":2,"name":"Security Weak Points: Social Media"}]},{"@type":"WebSite","@id":"https:\/\/www.n-able.com\/de#website","url":"https:\/\/www.n-able.com\/de","name":"N-able","description":"","publisher":{"@id":"https:\/\/www.n-able.com\/de#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.n-able.com\/de?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"de"},{"@type":"Organization","@id":"https:\/\/www.n-able.com\/de#organization","name":"N-able","url":"https:\/\/www.n-able.com\/de","logo":{"@type":"ImageObject","inLanguage":"de","@id":"https:\/\/www.n-able.com\/de#\/schema\/logo\/image\/","url":"https:\/\/www.n-able.com\/wp-content\/uploads\/2021\/02\/logo-n-able-vertical-dark.svg","contentUrl":"https:\/\/www.n-able.com\/wp-content\/uploads\/2021\/02\/logo-n-able-vertical-dark.svg","width":"1024","height":"1024","caption":"N-able"},"image":{"@id":"https:\/\/www.n-able.com\/de#\/schema\/logo\/image\/"},"sameAs":["https:\/\/www.facebook.com\/NableMSP","https:\/\/x.com\/Nable","https:\/\/www.linkedin.com\/company\/n-able","https:\/\/www.youtube.com\/channel\/UClnp77HHg4aME-S-3fWQhFw"]},{"@type":"Person","@id":"https:\/\/www.n-able.com\/de#\/schema\/person\/f46a000e389b6d02bd4b3866e7828a7b","name":"N-able","image":{"@type":"ImageObject","inLanguage":"de","@id":"https:\/\/secure.gravatar.com\/avatar\/e9c468b7c98137ecdd5508befa660c205a7978133257080a37fb0b1362d53411?s=96&d=mm&r=g","url":"https:\/\/secure.gravatar.com\/avatar\/e9c468b7c98137ecdd5508befa660c205a7978133257080a37fb0b1362d53411?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/e9c468b7c98137ecdd5508befa660c205a7978133257080a37fb0b1362d53411?s=96&d=mm&r=g","caption":"N-able"}}]}},"_links":{"self":[{"href":"https:\/\/www.n-able.com\/de\/wp-json\/wp\/v2\/posts\/5410","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.n-able.com\/de\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.n-able.com\/de\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.n-able.com\/de\/wp-json\/wp\/v2\/users\/24"}],"replies":[{"embeddable":true,"href":"https:\/\/www.n-able.com\/de\/wp-json\/wp\/v2\/comments?post=5410"}],"version-history":[{"count":0,"href":"https:\/\/www.n-able.com\/de\/wp-json\/wp\/v2\/posts\/5410\/revisions"}],"wp:attachment":[{"href":"https:\/\/www.n-able.com\/de\/wp-json\/wp\/v2\/media?parent=5410"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}