May 18, 2009, 11:39 AM — Identity thieves that hit Facebook last week with a new round of phishing attacks are harvesting passwords for profit, a security researcher said today.
"It's not surprising that they're targeting Facebook," said Kevin Haley, a director on Symantec's security response team. "Facebook has, what, 200 million-plus users? The bad guys always go where's there's a lot of people."
The newest Facebook attacks resemble previous phishing rounds in their tactics: A compromised account sends a malicious link to friends. That link leads to a site that mimics the legitimate log-in page. But users duped into entering their usernames and passwords are likely giving away more than just their Facebook credentials, said Haley.
"Certainly this isn't new," he said, "but we think that what you're seeing is an attempt to shake out every last dollar they can get."
The criminals are operating on the assumption that the Facebook password they acquire from any given user has a good chance of being the same password that person uses on other sites, such as online shopping services or even bank accounts.
"Get one password for the right person and it's like having their wallet handed over," Symantec researcher Marian Merritt in the post to Symantec's security response blog said on Friday.
Although Symantec has no statistics on the percentage of users who rely on just a single password for multiple online services or activities -- Haley called the evidence "anecdotal" -- it's an assumption that both criminals and researchers make. "When you talk to users, that's what they tell you they do," he said.
Facebook has acknowledged the attack, and said it has reset passwords of compromised accounts and eliminated the phishing messages when it has found them.
"It's not like this is some great new virus technology," Haley said, noting that the newest attacks are unlike worm-based attempts to infect Facebook accounts with the Koobface worm. This is straight con job. "Cons have been known from the beginning of time," Haley continued. "But now we're seeing them coming a little faster and more furious."
The problem with social sites like Facebook is that they portray a certain level of trust -- others are "friends," after all, Haley added -- and while users' may be wary of clicking on links delivered via traditional e-mail, they haven't yet made the same connection to social networking.
"People are very wary of e-mail [phishing attacks]. They've begun to catch on," said Haley. "But they don't have their antenna up when it comes to social networking."
Symantec's Merritt urged users to use more caution before clicking on links, to double-check the site's URL and to use more, and more complex, passwords.
But Haley is pessimistic that the advice would sink in anytime soon. "It's a progression," he said, referring to the learning curve users go through before they realize they need to take care of their identities in a new online technology or type of service.
Even then, it's a never-ending fight. "If there's a way to figure out a new way to attack, the bad guys will do it," Haley concluded.
