Facebook, LinkedIn, Twitter: The New Cyberweapons Of Choice
New social media scams and marketing #fails are common fodder for water cooler banter today – even a recent episode of HBO’s Veep ran a joke where the President blames a Chinese cyberattack for sending an ill-advised tweet.
But social media cybersecurity issues are far from a laughing matter, and it’s time we all take notice. Our new report Four Ways Cybercriminals Exploit Social Media proves this.
Poor social media security practices put you, your brand, your customers, your executives, and your entire organization at serious risk. According to Cisco, Facebook scams were the most common form of malware distributed in 2015, and in its most recent annual internet crime report, the FBI highlighted that social media-related events had quadrupled over the past five years. Social media is also increasingly an effective tool for terrorist groups like ISIS, even as Twitter and other social networks work around the clock to remove associated accounts.
So why is social media such a serious cyberweapon today?
- Major social networks can’t secure their own environments – let alone yours. As much as they might try to mitigate security threats on their platforms, social networks are not 100% effective – not by a long shot. For example, Facebook’s 2015 10-K identifies up to 2% of its 1.59 billion monthly average users (MAUs) are “false accounts” – meaning that despite its best efforts, over 31 million false accounts still remain live on its platform at any point in time; Twitter’s 2015 10-K estimates 5% of its MAUs are false; and LinkedIn’s 2015 10-K admits, “We don’t have a reliable system for identifying and counting duplicate or fraudulent accounts.”
- Social media scams are highly-effective and lucrative. Data shows that we implicitly trust people’s activity on social media, more so than on any other communications channel. This (misguided) trust becomes a treasure trove for cybercriminals to manipulate, resulting in rampant scams across social networks, including everything from counterfeit sales, to brand impersonations, to customer fraud. The high volume of visible social media fraud activity led security experts at RSA to go so far as to call it a “global epidemic.”
- Cybercriminals weaponize social media and its data. Malicious adversaries leverage social media as a key part of planning and executing targeted cyberattacks against your organization.LinkedIn was a key “recon” tool for the cybercriminals who executed the Anthem data breach and its 80 million stolen records. Twitter was the target of an innovative malware exploit dubbed “Hammertoss” – which is rumored to be connected to the Pentagon’s data breach last summer that took down the security agency’s 4,200 employee email server for two weeks, and stealing undetermined amounts of data.
For the most part, social media doesn’t create wholly new cyberthreats, but it does substantially amplify the risks of existing ones. In our new report, we identify how social media boosts the effectiveness of four common tactics that cybercriminals have been employing for years:
- Reconnaissance: Gathered via scraping of public social data and social engineering tactics, cybercriminals have far greater and easier access to data that enhances the situational context of their targets and compromises accounts and systems.
- Technical exploit delivery: See the Hammertoss example above. Cyberattackers take advantage of social media to distribute malware at little cost, and on a massive scale – often with far less scrutiny.
- Brand hijacking: Now a default digital points of presence for your brand, social accounts are susceptible to account takeovers (e.g., Michigan University and its compromised Facebook pages), impersonations, hashtag hijacking, and product scams – all of which damage the image of your brand and result in a diminished customer experience.
- Threat coordination: Much to the contrary, when it comes selling illicit goods and communicating securely, public social networks are often just as active as the dark web.
What does all of this mean? Security pros and marketers alike (yes, marketers too) must accept that social media is a real cyberthreat, and integrate security best practices into their brand and security strategies immediately. Be sure to read our full report to get a lot more detail about how cybercriminals exploit social media today, the sophisticated tactics they now deploy, and the practical steps you can take to mitigate the risk.
In ironic fashion, you can find me on Twitter @nickhayes10 where I plan to keep the conversation going!