Table Of ContentSyngress is an imprint of Elsevier.
30 Corporate Drive, Suite 400, Burlington, MA 01803, USA
This book is printed on acid-free paper.
© 2010 Elsevier Inc. All rights reserved.
No part of this publication may be reproduced or transmitted in any form or by any means, electronic or
mechanical, including photocopying, recording, or any information storage and retrieval system, without
permission in writing from the publisher. Details on how to seek permission, further information about the
Publisher’s permissions policies, and our arrangements with organizations such as the Copyright Clearance
Center and the Copyright Licensing Agency, can be found at our Web site: www.elsevier.com/permissions.
This book and the individual contributions contained in it are protected under copyright by the Publisher (other
than as may be noted herein).
Notices
Knowledge and best practice in this field are constantly changing. As new research and experience broaden our
understanding, changes in research methods, professional practices, or medical treatment may become necessary.
Practitioners and researchers must always rely on their own experience and knowledge in evaluating and using
any information, methods, compounds, or experiments described herein. In using such information or methods
they should be mindful of their own safety and the safety of others, including parties for whom they have a
professional responsibility.
To the fullest extent of the law, neither the Publisher nor the authors, contributors, or editors, assume any liability
for any injury and/or damage to persons or property as a matter of products liability, negligence or otherwise, or
from any use or operation of any methods, products, instructions, or ideas contained in the material herein.
Library of Congress Cataloging-in-Publication Data
Application submitted
British Library Cataloguing-in-Publication Data
A catalogue record for this book is available from the British Library.
ISBN: 978-1-59749-545-5
Printed in the United States of America
10 11 12 13 5 4 3 2 1
Elsevier Inc., the author(s), and any person or firm involved in the writing, editing, or production (collectively
“Makers”) of this book (“the Work”) do not guarantee or warrant the results to be obtained from the Work.
For information on rights, translations, and bulk sales, contact Matt Pedersen, Commercial Sales Director and
Rights; e-mail: [email protected]
For information on all Syngress publications,
visit our Web site at www.syngress.com
Typeset by : diacriTech, Chennai, India
About the Authors
Lead Author
Carl Timm is the Regional Director of Security for Savvis Communications. As
Regional Director of Security, Mr. Timm is responsible for assisting companies with
creating and implementing robust security programs. Mr. Timm has worked in the
Information Security area for over 16 years providing security and IT governance
consulting services for fortune 500 companies. Mr. Timm is also an industry-
recognized author, having written several books on the topics of security and
networking. Mr. Timm holds multiple industry certifications including the CCIE,
CISSP, and PMP.
Contributing Author
Richard Perez (CISSP#121490, CCNP, MCSE, SCSA, CCSE, CNE-3, ITIL) is a
senior security, risk and architecture practice manager for Savvis, Inc. He currently
provides strategic and technical consulting to clients in the Midwestern United States.
His specialties include network and system security, enterprise architecture, business
continuity, and disaster recovery.
Richard holds a Bachelor’s degree in Computer Science, a Master’s degree in
Information Technology, and is presently completing his Doctorate in Computer
Science. He is a member of the Association for Computing Machinery (ACM), (ISC)2,
and InfraGard. Richard currently resides in the Northwest suburbs of Chicago, IL
with his wife Kelly and his four sons, Tyler, Stuart, Seth, and Caden.
Technical Editor
Adam Ely (CISSP, NSA IAM, MCSE) is Director of Corporate Security for TiVo,
where he is responsible for IT security and corporate security policies. Adam has
held positions with The Walt Disney Company where he was Manager, Informa-
tion Security Operations for the Walt Disney Interactive Media Group and Senior
Manager, Technology for a Walt Disney acquired business. In addition, Adam was
a consultant with Alvarez & Marsal where he led security engagements for clients.
Adam’s background focuses on application and infrastructure security. Adam has
published numerous application vulnerabilities, application security roadmaps, and
other articles.
ix
Acknowledgments
This book has been a trying task and we hope you enjoy it. I would like to send out
a special thanks to Rich Perez for saving me, as well as Matt and Rachel for putting
up with me and dealing with my tardiness. I would also like to thank everyone else
involved for your hard work, especially my tech editor, Adam Ely, who kept me in
check. The biggest thanks of all has to go out to my wife Bobbie, two precious angels
Lexi and Sami, and my son Trevor for dealing with the long hours without their
husband and daddy. Rich and I hope that all who read this book will always protect
themselves and the ones they love.
xi
Introduction
InformatIon In thIs Chapter
• Overview and Key Learning Points
• Book Audience
• How this Book Is Organized
overvIew and Key LearnIng poInts
What is a social network? Some of you know this already. If you don’t, you are
about to find out. This book is going to take you through the seven deadliest social
networking attacks. Kinda scary sounding, isn’t it? Enough with the hubbub. Before
we start attacking the social networks, we should probably understand what allows
them to run.
So, what is the basis behind a social network? It is something called Web 2.0.
Maybe you have heard of it, maybe you haven’t – it doesn’t matter. What is Web 2.0?
So glad you asked that question.
Well, we know what the Web is: it is the World Wide Web. This is a place where
we can find anything we want. However, what the heck is Web 2.0? You have heard
about it on the Web and you have heard about it from your friends, but you still don’t
know. Is it the second coming of the Web? No. Is it a new version of the Internet? You
are still way off. You probably won’t be happy with this explanation – keep in mind,
neither were we when we found out.
Right now, you are probably tired of this long drawn-out intro to Web 2.0.
However, it’s like that suspense movie you love so much: it takes a while to get to
the point; it is something called “dramatic effect.” Enough of that. Web 2.0 is a term
that was coined by a single person talking to a single company. A man by the name
of Tim O’Reilly was discussing the Internet with Dale Dougherty. They had noted
that “far from having ‘crashed,’ the Web was more important than ever, with exciting
new applications and sites popping up with surprising regularity. What’s more, the
companies that had survived the collapse seemed to have some things in common.
Could it be that the dot-com collapse marked some kind of turning point for the Web,
such that a call to action such as ‘Web 2.0’ might make sense? We agreed it did, and
so the Web 2.0 conference was born.”1 Don’t you like history? Hope so!!
xiii
xiv Introduction
It is really funny how a simple name created in conversation can take hold.
However, this is the industry we make our livings in and a simple term can change
the entire direction of thought. After a year and a half from them coining the term,
it had really caught on and everyone wanted to know what it was. Really, they had
9.5 million citations in Google from a simple conversation. So, they sat down and
tried to layout what it might be. What they came up with from that initial discussion
is listed in Table I.1.1
You really have to keep in mind that the list went on and on and on. This is only
a brief list. By now you have to be asking yourself, “What makes something 1.0 and
something 2.0?” This is a very valid question. We are asking ourselves the same
questionJ Not really.
So what are the differences, you ask? Well, let’s find out. Take a look at Table I.2.
What does this all mean to us, you may ask? It makes our lives easier; however,
it also makes our lives more complicated. What does that mean? It means that at the
cost of having a more enjoyable browsing life, the ease of use, we become victim to
the information shared. By this time, you are probably ready for a bit more insight.
That is exactly what you are going to receive. At this time, it is time to focus on the
social networking sites, which is based upon Web 2.0.
Social networks are sites that have exploded into the tech scene with a consider-
able amount of popularity and fanfare. At first, many people (including myself) felt
that social networking was nothing more than a fad. However, in 2006, advertising
on U.S.-based social networking sites such as MySpace and Facebook accumulated
over $350 million dollars (US). Facebook appears to be leading the charge as one
of the hottest growing social networks. With an active user count of over 60 million
Table I.1 How did Web 1.0 become 2.0?
What became What?
Web 1.0 Web 2.0
DoubleClick Google AdSense
Ofoto Flickr
Akamai BitTorrent
mp3.com Napster
Britannica Online Wikipedia
Personal Web Sites Blogging
Evite upcoming.org and EVDB
Domain Name Speculation Search Engine Optimization
Page Views Cost per Click
Screen Scraping Web Services
Publishing Participation
Content Management Systems Wikis
Directories (Taxonomy) Tagging (“Folksonoly”)
Sickiness Syndication
Introduction xv
Table I.2 Comparison of Web 1.0 to 2.0
Web 1.0 was about: Web 2.0 was about:
Reading Writing
Companies Communities
Client-server Peer-to-peer
HTML XML
Home Pages Blogs
Portals RSS
Taxonomy Tags
Wires Wireless
Owning Sharing
IPOs Trade Sales
Netscape Google
Web Forms Web Applications
Screen Scraping APIs
Dialup Broadband
Hardware Costs Bandwidth Costs
subscribers and with more than 13 thousand applications at its disposal, there is a
wide expanse to express ideas, collaborate, and collect information. Facebook as of
this writing stands as the fourth largest Web site in the world, having grown 157%
(trailing only Google, Microsoft, and Yahoo). Twitter, between the years of 2008
and 2009, grew by 1,928% in the United States alone. Growth within the social
networking segment as derived from Forrester ResearchA indicates that social media
marketing spend will be $714 million in 2009, with a growth to be at $3.1 billion
by 2014. Even such a difficult situation as the global recession is doing little to
impact the momentum of social networks. Social networks geared at professionals
such as LinkedIn received 7.7 million unique visitors just from subscribers within the
United States in 2009.B LinkedIn currently has an active user count that now exceeds
30 million users globally in a span of five years.
Social networks have an international appeal, as noted with recent international
incidents and as noted within Iran upon their presidential elections. Twitter became
a very visible and useful tool for the Iranian people to share what was taking place
despite the government’s crackdown on the International press. In a recent study
conducted by Comscore,C social networking’s heaviest and most active users are in
Russia, averaging around 6.6 h per month. Brazil ranked second only to Russia with
6.3 h per month, followed by Canada with 5.6 h, Puerto Rico with 5.3 h, and Spain
Ahttp://mashable.com/2009/07/08/social-media-marketing-growth/
Bwww.digitalbuzzblog.com/linkedin-popularity-grows-as-economy-sours/
Chttp://eu.techcrunch.com/2009/07/02/comscore-russians-spend-more-time-on-social-networks-than-
rest-of-world/
xvi Introduction
matching with 5.3 h. For those of you who were wondering where the United States
fit in, statistically they ranked ninth with an average usage of 4.2 h per month. The
amount of time spent on social networks just within the United States alone rose
83%D just in over a year’s time.
As technology ages in dog years, our desire to communicate and express our-
selves online has only begun to flourish through mobile technologies and Web 2.0
applications, which have resulted in improved user-centric design and interoperabil-
ity. Social media applications have yielded a ripe cornucopia of information sharing
and collaborative tools for the World Wide Web that have greatly impacted the world
of hosted services in a successful resurfacing within the social arena, resulting in a
plethora of blogs, shared video sites, wikis, collaborative whiteboarding tools, and
social networking sites built upon the interactive facilities that are provided through
an hierarchy of platform-based computing. While Web 2.0 is merely a term for what
Web services have evolved into, it’s evident to see that the human interaction with
Web services has only just begun to really take shape. Content through these evolv-
ing Web services continues to increase in its value through the further enrichment by
human interaction.
As with all good intentions, there’s always room to exploit. Social networks
have been the target for many in obtaining personal information and to achieve
unscrupulous financial gain. Attacks on social networking as a result of all this
attention is up by more than 240%E just from phishing attacks alone. According
to a recent report published by the Internet Crime Complaint Center (iC3),F
computer fraud was the fifth highest complaint type received, representing an
average (median) loss per complaint of $1,000.00. Nigerian Letter Fraud surpris-
ingly ranked higher as the fourth highest complaint type received, with an average
reported loss per complaint of $1,650.00. Hybrid attacks involving a combination
of social engineering in combination with computer intrusion was also commonly
reported. Alongside these attacks, individuals are giving away easily character-
istics about themselves, which consequently makes them easy targets to exploit
in confidence. By having gender-detectable e-mail addresses and participating
in responding to strange messages, individuals have been found lurking on chat
rooms and mailing lists and social forums where they have been very success-
ful in gaining trust easily with those who are unknowing of the tactics that these
criminals perform. By gaining the victims’ trust, these cybercriminals eventually
lead their victims to quickly divulge personal information or con the victim into
go against their instincts to defend themselves and relinquish additional informa-
tion about themselves for further exploitation or severe financial loss. With all the
time, information and resources being divulged within social networks, it’s of no
surprise that there are so many who want to exploit the well of information and
capital being flung in that direction.
Dwwwreuters.com/article/idUSSP47166820090603
Ewww.darkreading.com/security/attacks/showArticle.jhtml?articleID=218101868
Fwww.ic3.gov/media/annualreports.aspx
Introduction xvii
This book is segmented into seven chapters examining some of the deadliest
attacks and ramifications in use with social networking. The book will provide a
comprehensive view into how these attacks have impacted the livelihood and lives
of adults and children. The goal of this book is intended to help provide insight to
these social networking attacks and offer preventive measures to aid in thwarting, if
not lessening, the impact of these types of activities. Social networking remains a
steadfast activity, both at home and at work (where permitted). Social networks allow
for the development in which to create and maintain a series of networks, which may
involve updating details to friends and family and work relationships, all possible
within the same context. While it is arguable as to whether such actions should be
allowed within the workspace questioning the loss of productivity, much of it will
depend on the culture of the organization and its overall position behind the nature of
socializing online. One thing’s for certain: whether it’s performed over a cell phone
or on a traditional landline, the human need to communicate and socialize is merely
an outlet extended more efficiently through social networking tools. By developing
a better understanding of the nature of these targeted attacks against social networks,
whether at home or within the workspace, the relevancy remains the same as much
of the computing habits at home are often mirrored at the workplace.
By developing a more thorough understanding of these types of attacks, our
intent is to provide our reader an armament of defensive measures and knowledge to
lessen the likelihood of being exploited. Within each and every chapter of this book,
the reader will be presented realistic scenarios where a variety of issues and counter-
measures will be examined, including an improved outlook to how these threats will
evolve, based on emerging trends.
BooK audIenCe
This book is intended to serve as a reference guide to anyone who is or will be
involved in oversight roles within the information security field. It will provide value
to those who are involved or interested in providing defense mechanisms surround-
ing social media. Information security professionals and those in the teaching profes-
sion will find value and insight to how social networking attacks surface and develop
strategies into improving not only awareness to the issues but also develop methods
in which improved and safer practices are instituted.
All levels of professional management may benefit in further understanding the
threats and attacks that can be performed within social networks, whether within the
workplace, smart phone, cybercafé, or from within the home. The material compiled
within the contents of this book are intended to serve as a field guide behind some
of the most prevalent threats found within the social networking space and present
techniques that may prove useful if in the event such a situation were to present
itself. Many of the scenarios which will be presented within this book are intended to
provide a look and feel that will be similar to those attacks that may be found taking
place presently in the field.
xviii Introduction
how thIs BooK Is organIzed
This book is separated into seven chapters, where each chapter will focus on a spe-
cific type of attack that has been furthered through the use of social networking tools
and devices. Each chapter is intended to take one through a comprehensive overview
of a particular attack whereby the reader will gain insight to how it was used, what
was accomplished as a result, and the ensuing consequences. Alongside examining
the anatomy of the attacks, insight will be gained to how to develop mitigation strate-
gies, including forecasts of where these types of attacks are heading.
The rationale behind the selection of criteria was based on the most popular
exploits taking place currently. Since its early adoption with the residential space, the
Internet has been a wild west of sorts with a desire to keep the services as open and
as free as possible. The tradeoff with freedom, however, is there was a high degree
of exploitation with taking advantage of the less mindful Internet users in the world
who simply did not have the background in building an effective defense against
both technical and social attacks. With commercialization, we’ve seen some tighten-
ing of controls despite efforts to instill net neutrality. With the bevy of activity from
spammers, criminals, and rogue governments, we felt that this was the appropriate
time to provide additional guidance. The regular trustworthy users and white hats of
the world are rather tired of constantly being exploited by these criminals. The book
was compiled primarily as means of taking an offensive measure towards develop-
ment of more aggressive dismantling of these deadly attacks. With what has been
observed through this research, we remain cautiously optimistic that good people of
the world now want to have ownership of the Internet in a responsible manner.
Many of the scenarios presented are based on actual events that have recently
taken place to illustrate the reality of what these attacks do to individuals who are
heavily involved in the social networking space. Other scenarios are partially based
on real events but have been altered to provide some level of discretion to protect
identities or to simply illustrate personal experiences from a third-person perspective
to provide additional content for educational purposes. Some scenarios are highly
publicized examples, which we attempt to provide additional insight based on our
research to provide a multidimensional perspective not only from the victim but
where possible from the attacker as well. By providing this two-sided coin perspec-
tive, we felt that this would provide the reader an overall comprehensive view so
that the experience is relatable and easy to understand. The scenarios presented are
intended to provide not only examples of what and how things went wrong but also
to more importantly provide reinforcement to measures that will better aid the reader
in understanding the magnitude of the risk and provide self-guiding techniques to
develop safeguards against would-be attackers.
Given the structure of this book, there is no set direction where the reader is
required to follow each chapter in a sequential order; rather, it is intended that
each chapter within its topic of focus stand by itself within the body of knowledge
researched and presented. This was purposely done to give the reader the arbitrary
path to choose where to start based on relevance or individual interest of a given
Description:consulting services for fortune 500 companies. Mr. Timm is also Mr. Timm holds multiple industry certifications including the CCIE,. CISSP, and PMP with his wife Kelly and his four sons, Tyler, Stuart, Seth, and Caden. Technical
