Facebook Graph Search is an awesome tool for phishing attacks

Facebook shook the tech world's foundation a bit with the announcement of Graph Search capability. Users are anxious for a chance to play with the new feature, and attackers are looking forward to this potent new weapon, er, tool as well.
In a nutshell, Facebook Graph Search is a search engine that allows you to find things based on relationships and context—basically drawing from the limitless pool of Likes, tags, and check-ins posted by a billion Facebook members.

Mark Zuckerberg unveiled Graph Search this week at a Facebook media event.

From a search perspective, Graph Search seems like a very powerful tool—something that makes search more personally relevant, and a concept that should have Google worried a bit. You can search based on people, places, friends, and interests. For example, you can do a search for “friends who like The Beatles and live in Chicago,” or “Italian restaurants my friends have visited nearby.”
However, it’s a bit of a double-edged sword as well. Andrew Storms, director of security operations for nCircle, says, “The new Facebook Graph Search is a phishers’ dream come true. It takes the micro-targeting capabilities that have been available to online advertisers for years and puts them into the hands of cyber criminals.”
Think of it like Google hacking on steroids. Attackers learned long ago that Google is a virtually endless treasure trove of valuable information—sensitive data, and seemingly innocuous tidbits that can be used to hack into a network or account. Facebook Graph Search raises the bar—and not in a good way—by delivering that same capability with a more personal context.
Alex Horan, security strategist for CORE Security points out the inherent conflict of interest of a tool like this because Graph Search is only useful if it provides relevant and interesting results. “This means Facebook will want it to have as much information available as possible to respond to each query, ensuring people have a positive experience. This directly goes against the desire expressed by people to keep their information private.”

Users have a tendency of ignoring privacy controls and oversharing.

Using Facebook Graph Search, an attacker can narrow down specific targets, and customize emails or Facebook messages using compelling details about their lives, their friends, the things that interest them, and the places they’ve visited.
Richard Wang, manager at Sophos Labs, says Graph Search might be a startling eye-opener for many. This will probably lead more users to discovering that they have shared more than they expected and gives scammers the opportunity to target particular groups of people.”
In a Facebook post about the Graph Search announcement, Robert Scoble praised the privacy model behind the tool. Scoble explains, “You can only see items shared to public or shared with you specifically due to your friend arrangements.”
That is true, and Facebook deserves credit for building in privacy controls. Unfortunately, many of the billion-ish Facebook users aren’t aware of, or don’t properly use the security and privacy controls—so everything they post on the social network will be easily discoverable by cyber criminals.
Horan clarifies, “From a hacker’s perspective, the data was already there and subject to target an attack, but this new feature makes it easier for attackers to collect similar targets for a more customized attack.”
“If you thought the level of spam and phishing scams on Facebook couldn’t possibly get worse, I have bad news for you. We ain’t seen nuthin’ yet,” warns Storms.

• Tweet
• Share
• Share
• Share
• Share

Sign up here with your email