Facebook Celebrates National Cyber Security Month

 

October was national cyber security month.  In honor of that, Facebook has announced some upcoming security updates.

Trusted Friends
Trusted Friends is a feature that helps you get back into your account if you are ever locked out for any reason.  You just select three to five friends that you trust (this is where the name comes in), and they are your fall back.  If you are locked out, Facebook will send them codes. You then get at least three of the codes from your trusted friends, and use the codes to login to your account and reset your password.

App Passwords
Facebook is also introducing app-specific passwords.  These are automatically generated passwords that will be necessary for logging into certain apps, which could otherwise be security risks.

You can view an infographic about Facebook security on Scribd.  (Why they used a third party image service rather than posting it on Facebook, I have no idea.)

The scary part here is in the stats they released on this infographic.  Four percent of the content on Facebook is spam.  When compared to email, this is low.  That being said, that is still almost one item in twenty.  Additionally only 0.06% of accounts are compromised daily.  Unfortunately, that 0.06% is of over one billion, adding up to over 600,000 accounts compromised every day.

Other than Facebook's latest attempts to make their site secure, there are some basic steps you can take to protect all of your accounts.

1.  Don't reuse passwords.
2.  Don’t use a common password, like your birthday.  Try a secure password generator, instead.
3.  Never share your login information.
4.  Change your passwords regularly, and anytime you think an account might be compromised.

Common sense can often save you quite a bit of trouble when it comes to internet security.

More Hacking News

Lists are fun!

• Hacking can be good or bad, white hat or black hat.
• Many of the "rogue" hacking groups lately gaining media attention are "grey" hat.  They aren't out solely to take advantage for their own gain, but they also are not working for companies or governments to help patch security flaws.
• LulzSec, discussed in a previous post, hacks "for the lulz."  They sometimes maliciously steal information and disperse it to the "Twitter Horde" to use as they will, but they also sometimes use their powers for good - exposing individuals who view or purchase child pornography and stealing their information in order to make their lives more difficult, for instance.
• LulzSec has also been releasing documentation lately illustrating that they have been alerting organizations to their security flaws and giving a grace period before attacking.  They are actively forcing companies and organizations to close their security gaps.
• Other "grey hat" hacking includes hacking that is neither malicious nor done to benefit others, like hacking the Microsoft Kinnect to do interesting things.
• The future of hacking promises to be exciting to say the least.  While the actual volume of hacking has not increased, it is becoming more publicized.  Additionally, the technologies at work are increasing and changing all the time.  Bill Gates has said that the future of hacking is in biology - learning the code of genetics well enough to manipulate or replicate in technology.
• The future of hacking seems to be of growing interest to many.  The first-ever Defcon Kid's conference is being held in Nevada this, and focuses on young and aspiring hackers, teaching the to use their powers of inquisitiveness for good.  Word has it that the ever-secretive NSA (National Security Agency) will be scouting young talent, as will many other organizations.

Rebels Without a Cause: LulzSec

Most people have heard of Anonymous.  They are a mostly-political activist group of hackers, or hacktivists. Anonymous has gained a fair reputation in the last several months for being powerful enough to take down what sites they like, for supporting file sharing, and for activities supporting revolution in the Middle East.

Aside from these morally motivated pursuits, Anonymous is also responsible for several less defensible attacks and pranks, such as bombarding YouTube with porn disguised as family-friendly film.

Lately, a new hacker group has been making headlines: LulzSec.  LulzSec, or Lulz Security, is a grey hat hacker group committed to revealing and making fun of embarrassing security flaws.  Grey hat in this case means neither malicious hacking for personal gain (black hat), or paid hacking meant to test security features and reveal gaps before they are exploited (white hat).  Big name hacks include PBS, Sony, Bethesda Games, pron.com, Infragaurd (affiliated with FBI), and CIA.

These attacks range from just-for-fun, pointing-out-a-problem-cause-we-want-to-help, on down to the government attacks, motivated by a statement made by the Pentagon that hacking could be considered an act of war.  LulzSec considers it a game, not war, and seemed upset by the comparison.  In retaliation, they hacked the Senate website, releasing some non-crucial data along with  taunting statement (previous link is to an article by LulzSec, contains profanity).

LulzSec's main message breaks down into a few points:

1. Don't everyone be so serious.
2. Be more careful with your security (don't reuse passwords).
3.   It's a game.  We're winning.

Personally, I'd say the first two are fairly good advice.