Reference no: EM133973595

Question

Trust is the main factor that is being exploited in social engineering attacks. Although internet users are becoming more suspicious of emails coming from unknown parties, attackers are constantly searching new ways to spread their malware using existing trust mechanisms. For example, internet users are often encouraged to visit only legitimate Web sites to reduce the risk of malware infections, but distinguishing between legitimate and illegitimate Web sites increasingly appears to be meaningless. According to a recent report by WebSense, seventy percent of the top 100 Web sites either hosted malicious content or contained a link designed to redirect site visitors to a malicious Web site. One of the reasons the web is so popular is that legitimate websites can attract large numbers of visitors, all of whom are a potential victim. Also, social networking websites, such as Facebook and Twitter, have increasingly become popular with hackers. Typically, hackers steal members' usernames and passwords and then bombard the victims' friends and family with thinly disguised marketing messages, directing them to third-party web pages containing malware. Computer users who would normally be suspicious of similar emails arriving in their regular inbox may be more susceptible when they are communicated via Facebook from a contact they believe to be a friend. While reports of extortion and false impersonation have been common in phony phone calls and fake e-mails, similar fraud hasn't been reported on Facebook until recently. Now a number of complaints are surfacing. For example, Bryan Rutberg's Facebook status update -- the way friends track each other -- suddenly changed on January 21 to this frightening alert: Bryan NEEDS HELP URGENTLY His online friends saw the message and came to his aid. Some posted concerned messages on his public profile -- "What's happening ? What do you need?" one wrote. Another friend, Beny Rubinstein, got a direct message saying Rutberg had been robbed at gunpoint in London and needed money to get back to the United States. So, trying to be a good friend, Rubinstein wired $1,143 to London. All these things happened while Bryan was at his home in Seattle.

(i) How can we defend against attacks that take advantage of these existing trust mechanisms?

(ii) How do you stay safe on social networking sites? Where does the best countermeasure lie against these scams: technology, education, or policy?

(iii) What kind of measures do social networking sites take to prevent impersonations?