It is a daily occurrence for many of us: when there are a few minutes of downtime, we check personal email, followed by a “quick” look at our social media accounts. While navigating the maze of a-friend-of-a-friend profiles, or clicking on a URL to bring up an article you discovered on twitter, do you ever stop to ask “How susceptible are my social media profiles?” or “What if that link I just clicked is malicious?” It is likely not a frequent question you ask yourself, and is a difficult question to answer, if you are not aware of the potential threats that exist within social platforms.
Background
A good starting point is to determine why threat actors find social media platforms—and their users—an attractive target. The number of active users on social media is huge, starting with Facebook at 2.4 billion users, followed by Instagram with 1 billion, then LinkedIn with 645 million, and finally Twitter with 330 million users. This highlights why social media platforms are becoming attractive tools for malicious actors to leverage. In addition to maintaining high user counts, a social media platform’s primary objective is to, well, be a social platform. They want us to share, share, and share some more—and when we are done sharing, they want us to consume what others are sharing. Many individuals on social media have developed a trust for the platform, and for their friends and followers. This “trust” lulls users into a false sense of security, and they are more inclined to click a link, or believe the validity of information. If a friend or follower of yours accidentally shares a link to a malicious website, you may be more apt to click the link unknowingly because it came from a trusted source. A user’s willingness to trust social media content is something an adversary wants to take advantage of.
Types of Threats
Now that we know a little as to why these platforms are leveraged by malicious actors, we need to discuss some of the tactics that are used against end users. Phishing—defined as a method of trying to gather personal information using deceptive emails and websites—has a huge play on social media platforms, and occurs multiple ways:
Impersonation Accounts
This tactic uses fake accounts to impersonate someone known by the target. If you know—or are familiar with—the user of that “account,” you are likely to consume the information they are sharing. For example, popular impersonation accounts are celebrities, customer service accounts, or a fake account created specifically to target your interests based on information in your profile.
Malicious Links
Imbedded within many impersonation accounts are URLs. These URLs can send you to a malicious site, or to a website that looks legitimate and asks you to register for an account. Once you create an account on the fake website, your personal information (including passwords) has been exposed.
Data Gathering
Conduct a quick review of the information in your own social media profile, or a handful of your posts. Have you ever identified your (or your mother’s) maiden name, your birthplace, or the name of your first pet? Do these questions seem familiar? That’s right, these are questions that reputable websites (like banks) ask you to complete in order to reset your password. If you have this information in your profile, a malicious actor could use it to build a specific profile on you that allows them to change your passwords and then access your accounts.
Staying Safe on Social Media
It was reported that the abuse of social media increased by nearly 200% in 2018, and that percentage continues to grow. What can be done to avoid social phishing attempts and stay safe on our social media accounts? Here are a few tips:
- Keep apps used to access your social media profiles up to date.
- Think about the link you are about to click on:
- Does it have https:// as part of the URL?
HTTPS is used for secure communication over the Internet or computer network.
- Be extra suspicious of shortened URLs, such as Bit.ly
or t.co.
Malicious actors use these services to mask the actual link they want you to click on.
- Are those puppies playing in a laundry basket cute enough to click the link to see more “cute” videos? The answer is no.
- Does it have https:// as part of the URL?
- Regularly review your privacy settings. Should your profile be completely public for anyone to see, or just for your approved friend list? Social media platforms can update these settings without users knowing of the updated changes. Be sure to check often.
- Do not download any software from social media platforms without absolutely trusting it first.
- Finally, it is OK to be suspicious—it is even
encouraged.
- Do not accept every follower request that comes your way without thinking about it first.
- Do not freely give out information to people who request it or information about yourself that you willingly put in your own profile.
Social platforms are a wonderful way to connect. They have become routine parts of our daily lives, and approaching them with extra vigilance in our daily use can certainly help us stay safe.
Robert Di Girolamo
Rob Di Girolamo is a Project Manager, Security Consulting and Professional Services, at Connection with more than ten years of experience. In his free time, he enjoys nature and outdoor photography, live music, and spending quality time with his family.
