kiran.ppt
- 1. October 29, 2022 Social Networks: Minimizing The Risks Of The New Frontier Venkatasubrahmanyam Krishnapur Senior Director Engineering, Consumer McAfee India Pvt. Ltd.
- 2. Confidential McAfee Internal Use Only October 29, 2022 2 Contents • Social networks – interesting stats and facts • Social networks – why the craze – a members view • Social networks – philosophy , motivation and where privacy is headed - a site creators or owners perspective • Social networks – the risks – Identity and reputation – social engineering • Social networks – the different attack vectors – malware , xss,csrf • Social networks – how do you minimise the risks ?
- 3. Social networks ….some interesting facts and stats
- 4. Confidential McAfee Internal Use Only “MySpace is a place for friends.” “MySpace is Your Space.” “MySpace keeps you connected.” “Twitter is a service for friends, family, and co-workers to communicate and stay connected through the exchange of quick frequent answers to one simple question: What are you doing?” “Your professional network of trusted contacts gives you an advantage in your career, and is one of your most valuable assets. LinkedIn exists to help you make better use of your professional network and help the people you trust in return.” “Delicious is a Social Bookmarking service, which means you can save all your bookmarks online, share them with other people, and see what other people are bookmarking.” “Giving people the power to share and make the world more open and connected.”
- 5. Confidential McAfee Internal Use Only
- 6. Confidential McAfee Internal Use Only 2/3rd US households use social networks, twice as many as a year ago Facebook has over 500 MILLION “active” users, - surpassing Google today There are 126 Million blogs on the internet People spend over 700 BILLION minutes per month on Facebook 10 BILLION+ Tweets Sent on Twitter Since 2006 2 BILLION Videos Are Streamed each day on YouTube The number of e-mails sent since 2006 – 90 TRILLION Social Networking facts – Believe it or not ! 2.5 BILLION photos are uploaded to Facebook every month = 1000 per SECOND ! By 2014 social networking services will replace e-mail as the primary vehicle for interpersonal communications for 20 percent of business users There are more than 75 million professionals on Linkedin and over 1 million companies
- 7. Social networking – why the craze ??
- 8. Confidential McAfee Internal Use Only Why Use Social Media? • It’s where the Friends are • Allows you to be part of a network with common interests, bonds, affiliations • Provides a sense of community • Seen as a forum to postulate views • Fun way to stay connected with old friends or make new friends • Forum for communication (individual/group/mass) and collaboration • Allows for self-expression and self- representation • “Democratizing innovation” • “Crowdsourcing” • Job hunting
- 9. Social Networks – Their Philosophy and motivation. Privacy – ha!ha!ha !
- 10. Confidential McAfee Internal Use Only Social Network “A” Additionally, you grant Social Network “A” a nonexclusive, irrevocable, worldwide, perpetual, unlimited, assignable, sublicenseable, fully paid up and royalty-free right to us to copy, prepare derivative works of, improve, distribute, publish, remove, retain, add, process, analyze, use and commercialize, in any way now known or in the future discovered, any information you provide, directly or indirectly to Social Network “A”, including but not limited to any user generated content, ideas, concepts, techniques or data to the services, you submit to Social Network “A”, without any further consent, notice and/or compensation to you or to any third parties. Any information you submit to us is at your own risk of loss. Social Network “B” “You hereby grant Social Network “B” an irrevocable, perpetual, non- exclusive, transferable, fully paid, worldwide license (with the right to sublicense) to (a) use, copy, publish, stream, store, retain, publicly perform or display, transmit, scan, reformat, modify, edit, frame, translate, excerpt, adapt, create derivative works and distribute (through multiple tiers), any User Content you (i) Post on or in connection with the Social Network “B” Service or the promotion thereof subject only to your privacy settings or (ii) enable a user to Post, including by offering a Share Link on your website and (b) to use your name, likeness and image for any purpose, including commercial or advertising, each of (a) and (b) on or in connection with Social Network “B” Service or the promotion thereof. You may remove your User Content from the Site at any time. If you choose to remove your User Content, the license granted above will automatically expire, however you acknowledge that the Company may retain archived copies of your User Content.” Privacy Policy Protection? LOL
- 11. Confidential McAfee Internal Use Only (blue = default availability of your personal data) The Evolution of “Network “A” “Privacy”
- 12. Confidential McAfee Internal Use Only A Friend of Mine Is A Friend of Yours
- 13. Social networking – The Risks….
- 14. Confidential McAfee Internal Use Only Information People Post in On-line Social Networks for Others to View – Identity loss • Name • Geography • Status • Sex • Year • Concentration • Residence • Birthday • Hometown • State • Zip • High School • Email • Preferred Email • Screen Name • Cell Phone • Address • Other Phone • Website • Sexual Preference • Relationship Interest • Relationship Status • Political Views • Interest • Clubs • Favorite Movies • Favorite TV Shows • Favorite Books • Favorite Quotes • About Me • Job Type • Company Job Title • Job Description • Work History • Pictures October 29, 2022 16 All or a combination of these can be used to construct a profile of yourself that can be used for nefarious activities by criminals !! Phishing attacks Picture stealing for porn sites Location tracking Financial fraud Reputation analysis (HR) Reputation damage Password stealing Predators in the guise of friends Government Agencies (Tax evasion) Literally anyone interested
- 15. Confidential McAfee Internal Use Only What Are The Security Risks?
- 16. Confidential McAfee Internal Use Only October 29, 2022 18 What is a Network? node node node node node node node node node node node node node node node node node Web Definition : A set of nodes, points, or locations connected by means of data, voice, and video communications for the purpose of exchange.
- 17. Confidential McAfee Internal Use Only Friends Viewers KEEPING IN TOUCH STAYING UP TO DATE LEAVING MESSAGES SENDING INVITATIONS ADDING TO SOCIAL GROUP ENCOURAGE MENT JUST TO SAY HI LOOK AT NEW PICTURES LOOKING FOR PERSONAL INFORMATION SEXUAL ASSAULT KEEPING TABS ON INDIVIDUAL OR GROUP STALKING SELLING DEVULGED INFORMATION PREDATORS HARASSMENT ATTEMPTING TO LOCATE OLD FRIENDS Unaffiliated USER Exposure possible due to : - a ‘friend’s account being compromised – now controlled by an impersonator - Inadvertently added someone as a friend – but not someone you know - Breach of trust by real friend (s) - Poor identity management ( privacy controls)
- 18. Confidential McAfee Internal Use Only October 29, 2022 21 Dangers and Misuse of On-line Social Networks Profile content and information could be gathered and used for the following: • Stalking • Arming Predators • Harassment • Sexual Assault • Slander Internet connectivity and a trusting attitude toward this technology can facilitate: • IP Tracking • Dangerous links • Spy ware threats • ID Theft • Information sold to third party
- 19. Confidential McAfee Internal Use Only What Are The Security Risks? • Malware distribution • Cyber-bullying (“trolling,” emotional abuse) • “Shelf-life” of information (lives forever in cyberspace) • Privacy concerns – Information about you that you post – Information about you that others post – Information about you the social networking sites collect and share with others
- 20. Confidential McAfee Internal Use Only Who’s peeking? • Friendsfamily • Friends of friendsfamily • Parents • Employers and co-workers – Dec 2009 study commissioned by Microsoft said 79% of recruiters & hiring mgrs researched applicants online – CareerBuilder.com study – 45% of employers use social networks to screen job candidates • Customers • Universities • Marketing companiesvendors • Criminalshackers • Government agencies (IRS, SRS!) • EVERYONE ELSE
- 21. Confidential McAfee Internal Use Only Take my stuff, please!
- 22. Confidential McAfee Internal Use Only Law of Unintended Consequences
- 23. Confidential McAfee Internal Use Only Legal Issues • Copyright violations • COPPA (Children’s Online Privacy Protection Act) covers sites directed to children under age 13 or general audience sites that know they’re dealing with kids younger than 13. • Cyberbullyingstalking laws (recent)
- 24. Confidential McAfee Internal Use Only Oh no! URL Shorteners • bit.ly, TinyUrl, ReadThisURL, NotLong • Hides the true destination URL – no way to tell where you’re going until you click! http://www.hacker.com/badsite?%20infect-your-pc.html is now http://bit.ly/aaI9KV
- 25. Confidential McAfee Internal Use Only Malware Distribution • Similar to other threats that can lead to downloading/installing malware – Malicious ads – Clickjacking (aka “likejacking”) – Wall posts, inbox or chat messages with malicious links from “Friends” (hijacked user account) – “My wallet was stolen and I’m stuck in Rome. Send me cash now.” – Spam email pretending to be from Facebook admins
- 26. Confidential McAfee Internal Use Only Malware Distribution
- 27. Confidential McAfee Internal Use Only Malware Distribution • Koobface is a well known malware targeting the biggest social network ; continues to evolve and infect today • Suspicious friend or follow request, or link • Bogus FB groups/Pages/profiles to entice you • Suspicious/malicious application mashable.com/2010/05/29/xxxxx-hilarious-video/
- 28. Confidential McAfee Internal Use Only XSS, CSRF Attacks – Inheritance of all the Web 2.0 vulnerabilities • Web 2.0 increased the power of dynamic and shareable content taking the internet to a different level. • However, the flat serial structure of html documents that included scripting amongst formatting and content introduced many risks. • Poor programming of Web 2.0 applications without proper validation can result in attack vectors like : – Cross site scripting attacks and cross-site request forgery attacks are serious concerns – These are attacks that exploit the trust the user has for a given site ( CSS) or the trust the site has in a user’s browser (CSRF) – SQL injection at the database layer • Hackers use a combination of social engineering and slick scripting to fool victims into running malicious code in their browsers. October 29, 2022 31
- 29. Confidential McAfee Internal Use Only 3rd Party Applications • Games, quizzes, cutesy stuff • Untested by the Social Networks – anyone can write one • No Terms and Conditions – you either allow or you don’t • Installation gives the developers rights to look at your profile and override your privacy settings!
- 30. Social networking sites ….Risk mitigation
- 31. Confidential McAfee Internal Use Only How technology helps ( SMB / Enterprises ) • Application control: – Granular application control, based upon the business and regulatory requirements of the organization, gives organizations the ability to create access policies specific to user identities, and to reduce risks for some employees without restricting participation for others. • Next-generation firewalls: – Many firewalls today don’t provide effective protection for Web 2.0 technologies. Organizations should consider next-generation firewalls that provide more sophisticated discovery, control, and visualization of applications, along with predictive threat protection for network infrastructures. • Endpoint protection: – The shared and highly participatory nature of Web 2.0 requires that businesses protect their endpoints against multiple threats, including spam, viruses, malicious software, spyware, rootkits, and hacker attacks. Endpoint protection remains a critical piece of information assurance and security in organizations. • Data loss protection: – Data exfiltration is a continuing challenge of organizations participating in the Web 2.0 environment. Protecting the integrity and confidentiality of organizational information from theft and inadvertent loss is a key issue today. Data loss protection guards private, sensitive, and confidential information and data from accidental or malicious loss. October 29, 2022 34
- 32. Confidential McAfee Internal Use Only How technology helps ( SMB / Enterprises ) • Encryption: – Important data should be encrypted, as should communication channels, with keying material kept separate from the encrypted material. Compromise or loss of endpoints should not automatically give access to sensitive information. • Authentication: – Strong, non-password based authentication should be deployed and used for access to sensitive information and resources. Web2.0 applications usually employ weak authentication, and are targets for a chain of penetration and social engineering attacks that can compromise valuable resources. Requiring appropriate token-based or biometric authentication at key points can help to prevent incidents. • Integrity Monitoring and Whitelisting: – Many current attacks against Web2.0-enabled hosts involve the installation or modification of code to enable access, or to install malware. Traditional anti-malware technologies are not sufficient to prevent these threats, so additional methods that use configuration integrity monitoring or application whitelisting should be considered. Solutions that monitor and control patching and upgrades should also be considered. • Gateway Anti-malware: – Proactive scanning of code in web pages for malicious intent. By analyzing the code at the web gateway—a gateway located physically in the enterprise or in the cloud as a hosted service, malware can be detected and blocked before it reaches the endpoint or other network assets. October 29, 2022 35
- 33. Confidential McAfee Internal Use Only Tips for Safer Social Networking ( Consumers ) • Use a strong, unique password • Provide as little personal information as possible – avoid revealing exact birth date, address – in general information that can be used to determine your identity. • Understand and customize the privacy settings in all of your social networking accounts • Use extreme care with 3rd party applications that access your information and change settings • Be careful about what you post – Photos of self or others – Opinions on controversial topics – Don’t rip classmates, professors, coworkers, employers …– it WILL come back to haunt you • Do not post anything related to your employer (unless you’re authorized) • Segregate your network – friends, colleagues, family • Supervise your kids’ use of social networking sites • Be a ‘friend’ of your kid • Use Family Protection Software .
- 34. Confidential McAfee Internal Use Only Tips for Safer Social Networking (Consumers ) • Be suspicious of friend/follow requests, ads, 3rd party applications, chat messages, etc. • Minimize exploration – don’t carelessly click on lots of ads, videos, games, etc. • Use built-in and add-on features in web browsers to warn you of malicious sites – Anti-phishing filters in IE and Firefox – Web of Trust – NoScript – Adblock Plus – Preview features of bit.ly, TinyURL • Use Web reputation software with real time analysis and remediation capability • Visit websites that have been scanned and certified • Google for your name frequently and look for privacy violations
- 35. Confidential McAfee Internal Use Only October 29, 2022 38 Conclusion • In conclusion , the value of social networking far outweighs the risks. • Use social networking effectively and positively to establish new relationships, strengthen existing ones, innovate, learn, collaborate, and have fun. • But beware of the risks so you can do your best to steer clear of them – Some of the dangers can easily be mitigated through common sense and discipline on the internet. – Use software products that rate and certify links and applications And importantly – think before you post and – think before you click !!