Turning Social Networks Against Users Technology Review (09/15/08) Naone, Erica
as it appeared in the September 15, 2008 edition of ACM TechNews.
Several research projects have explored the viability of distributing malicious software through social networks. At this week's Information Security Conference in Taipei, Taiwan, researchers from the Foundation for Research and Technology Hellas (FORTH) in Greece will present details of an experiment that enlisted Facebook users in a potentially devastating Internet attack. The researchers created an application that displays photographs from National Geographic on a user's profile page, but also requests large image files from a target server. If enough people added the application to their page, the flood of requests could shut down a server or render it inaccessible to legitimate users. FORTH research assistant Elias Athanasopoulos says the researchers made no effort to promote their application but 1,000 Facebook users installed the application within a few days. The resulting attacks, launched against a server the researchers established to receive the attacks, were not severe, but Athanasopoulos says they could disrupt a small Web site, and they could be made more intense with a few minor adjustments. A more detailed analysis of different social networking sites, by computer-security consultants Nathan Hamiel of Hexagon Security Group and Shawn Moyer of Agura Digital Security, found that the potential for damage is far more severe. The two built examples of malicious applications on top of OpenSocial, an open application platform used by MySpace, Orkut, and several other social networking sites. One of the demo applications, DoSer, logs out users who view a compromised page for several seconds. Another, CSFer, sends unauthorized friend requests from the target users. Hamiel says there are many more ways to attack social networks and there is little that can be done to defend them. Click Here to View Full Article
