January 16, 2013, 3:30 PM — Facebook shook the tech world's foundation a bit with the announcement of Graph Search capability. Users are anxious for a chance to play with the new feature, and attackers are looking forward to this potent new weapon, er, tool as well.
In a nutshell, Facebook Graph Search is a search engine that allows you to find things based on relationships and context--basically drawing from the limitless pool of Likes, tags, and check-ins posted by a billion Facebook members.
From a search perspective, Graph Search seems like a very powerful tool--something that makes search more personally relevant, and a concept that should have Google worried a bit. You can search based on people, places, friends, and interests. For example, you can do a search for "friends who like The Beatles and live in Chicago," or "Italian restaurants my friends have visited nearby."
However, it's a bit of a double-edged sword as well. Andrew Storms, director of security operations for nCircle, says, "The new Facebook Graph Search is a phishers' dream come true. It takes the micro-targeting capabilities that have been available to online advertisers for years and puts them into the hands of cyber criminals."
Think of it like Google hacking on steroids. Attackers learned long ago that Google is a virtually endless treasure trove of valuable information--sensitive data, and seemingly innocuous tidbits that can be used to hack into a network or account. Facebook Graph Search raises the bar--and not in a good way--by delivering that same capability with a more personal context.
Alex Horan, security strategist for CORE Security points out the inherent conflict of interest of a tool like this because Graph Search is only useful if it provides relevant and interesting results. "This means Facebook will want it to have as much information available as possible to respond to each query, ensuring people have a positive experience. This directly goes against the desire expressed by people to keep their information private."
Using Facebook Graph Search, an attacker can narrow down specific targets, and customize emails or Facebook messages using compelling details about their lives, their friends, the things that interest them, and the places they've visited.