Fearing Facebook Phishers

Criminals are counting on the circles of friends nurtured by social networking sites to make a killing -- ugly MySpace pages notwithstanding :)

Social Networking Accounts Prized By Cybercrooks - washingtonpost.com Security Fix

Quote:

---

In an analysis of cyber crime activity in the 2nd half of 2007, security vendor Symantec Corp. found that two social networking sites together were the target of 91 percent of U.S.-based phishing Web sites. Social networking sites also were the leading targets of phishing sites located in four other countries listed by Symantec in its phishing Top 10.

Hijacked social networking pages often are used to host malicious software or "malware" directly or to host links phishing or malware sites that are then advertised in messages sent to all of the contacts in the victim's social network.

---

Keep those Facebook credentials close to your chest!

That doesn't surprise me though...bunch of punk kids on facebook make for prime targets.

LOL! I would tend to agree. Unfortunately, some good people can get caught in that trap.

But I wonder to what end? I know that some profiles are chock full o' personal data (birthdates, locations, phone numbers, etc. -- a stalker's paradise, BTW). Besides spreading malware, is ID theft the ultimate goal?

ID theft does not have a high profit margin for resale. IDs are sold for 6 bucks each in the black market. If ID theft is the goal, it has to be for a targeted reason. In other words, the ID theft would have to lead to the real prize such as posing as a bank president in order to move large amounts of funds, and so on. Fast and effective distribution of malware is the primary goal from our intelligence sources.

--TH13

Infosec vendors are horrible sources for data. Ebay + Paypal make up for so much phishing that they are usually ignored for reports like these. It's 'assumed' that they're getting raped by phishing constantly and impossible to make a pitch if it looks like they're hogging all the attacks. Removing them from the picture, you still have all the banks to worry about before looking into the consumer web space. Regardless, phishing is on the rise across all industries. Halifax especially. Any site with users and a login is subject for abuse, the more users the better.

Symantec also doesn't seem to be a member of the APWG, so perhaps we should look there for comparison:
http://www.antiphishing.org/reports/...categories.jpg
http://www.antiphishing.org/reports/...t_dec_2007.pdf

Ghostwritten blog spam if you ask me. journalism 2.0

Good points, thanks for the link!

This is rather interesting:

http://www.newsday.com/technology/wi...,5039969.story

Apparently there is fierce competition amongst the crooks and this has driven prices down to $0.40 for a CC and $2 for an ID

2600s editorial this month talks about how people post their entire lives up on the web for all the world to see. That got me to thinking about the old days. You used to have to know someone a long time before you might give your actual first name and the general area that you were from. Everyone had their handles they used and protected their anonymity as much as possible. I can remember that some would even always log in throgh proxy servers so you couldn't traceroute them.

Now days, you can google a nick or any name, and get a list of the web sights they have posted.