Social networking sites such as MySpace, Facebook and Bebo have experienced a huge surge in popularity recently. Sites like these allow users to communicate with their friends and meet new friends, but they can also expose them to malware, phishing and other online dangers. As the use of Web 2.0 applications, like social networking sites, wikis and blogs continues to rise, they are attracting increased attention from cyber criminals. Many of the users flocking to these sites are new to the Internet and lack experience in dealing with online threats.

All of the threats described in this article have now been eliminated by site owners, but new ones will inevitably arise as attackers develop their techniques in response to increased security measures. Social networking sites are attractive targets as their interactive nature allows them to spread threats very quickly. Many of these threats exploit the trust people have in their friends, emphasizing the fact that it is important to treat electronic communications with care, no matter who they appear to be from.

As with other aspects of Internet use, threats can be divided into two categories: behavior-based and technology-based.

Behavior-Based Threats

Behavior-based threats exist because users are not careful enough about the personal information they share online and make themselves vulnerable to phishing attacks and identity theft. Users can publish information about their friends, their likes and dislikes, their jobs and hobbies, totally oblivious to the fact that that this information is eagerly sought by identity thieves as it can help them improve their credibility.

Research carried out by IT security company Sophos on a random sample of Facebook users showed that 41% were prepared to divulge personal information like email address, date of birth and phone number to a complete stranger. The research involved creating a fictitious Facebook profile for a green plastic frog named Freddi and sending out 200 friend requests to randomly-chosen users throughout the world. 87 of the users contacted responded and 82 of them supplied personal information, including email addressed, date of birth, details about their education or workplace, address and phone number, as well as photos of friends and family and information about spouses, likes and dislikes and hobbies.

Research carried out in 2007 by Internet Safety website Get Safe Online, showed that one in four UK social networking users had posted confidential personal information, such as their phone number or address on their profiles. 13% of users had posted information or photos of other people online without their consent. This figure rose to an alarming 27% among 18-24 year-olds.

Phishing isn't the only threat to be found on social networking websites. Eleven students at a high school near Toronto were suspended for posting comments about their principal on Facebook after the school imposed a ban on electronic devices and implemented a uniform policy. A school spokesman described the comments as vulgar and profane and claimed that they amounted to amounted to cyber-bullying.

There have been several stories claiming that young girls have been raped by older men who encountered them via MySpace or Facebook, but none of these appear to have been conclusively proved. The real problem is that social networking sites offer an opportunity for men to meet young girls in an unsupervised environment, something which should be of grave concern to parents.

Threats Based on Technology

Social networking sites can also be a source of technology-based threats. They allow millions of users to post content, so it's almost inevitable that some of these will be malicious individuals who will try to post viruses or spyware.

At the beginning of 2008 more than three million Facebook users were infected with spyware in less than four days. A widget named "Secret Crush" or "My Admirer" is thought to have been downloaded by one and a half million users. It claimed that it would tell users who had a secret crush on them, but actually tricked them into downloading the infamous Zango spyware, which spread by asking unsuspecting users to forward it to five friends.

Anti-virus vendor Symantec has claimed that vulnerabilities which could be used by hackers to take control of Windows PCs have been found in ActiveX controls offered to users for uploading images to their pages by both Facebook and MySpace. The insecure controls are based on an ActiveX control named Image Uploader, produced by Aurigma Inc.

MySpace was forced to shut down briefly in late 2005 after more than a million users were infected by the Samy worm, written by 19-year old Samy Kamkar. The worm added a million friends to his profile within a few hours, placing the string "but most of all, Samy is my hero" on each of their profiles. Kamkar was eventually sentenced to three years of probation and ordered to perform 90 days of community service.

In January 2008 a 17-gigabyte file containing more than half a million pictures obtained from private MySpace profiles appeared on BitTorrent, a well-known peer-to-peer file sharing service. This is biggest privacy breach to date on a social networking site. It was made possible because a security vulnerability, first reported in Autumn 2007, allowed hackers to access the photo galleries of some MySpace users who had set their profiles to private. This is the default setting for users aged under 16. This attack allowed pedophiles and voyeurs to target vulnerable 14- and 15-year-old users.

In December 2007, Brazilian users of Google's Orkut application were attacked by a worm that tried to hijack compromised computers and steal bank account details. It spread via booby-trapped links placed on the personal page of Orkut users and infected users when they viewed messages sent by friends who had already been exposed.

Google was quick to close the loophole which allowed the attack to take place, but another worm, named Scrapkut, appeared early in 2008. It appeared relatively harmless at first, but it was soon determined that it could intercept the login sessions several Brazilian banking Web sites and replace particular sections with a fake authentication prompt which would capture the users' logon credentials.

YouTube has also been used indirectly to infect sites with malware. Many Internet users have received spam messages asking them to click on an attached YouTube video clip. The link actually takes them to a fake YouTube sight where they are told that they must install Adobe Flash Player to play the video. Clicking the supplied download link causes a file called install_flash_player.exe. This is the same name as the real Flash installer, but it actually installs a Trojan known as Trojan-Dropper.W32/Agent.

Fighting Back

We've looked at some of the dangers you need to guard against on social networking sites, but what can you do to protect yourself against them? Technology-based attacks can often be repelled by the usual software defenses, ie: anti-virus software can prevent infection by viruses, trojans and worms, and anti-spyware programs can protect you against spyware and adware. A top-quality firewall (remember that the one supplied with Windows XP is fairly basic) can protect you against hackers and Internet safety suites can offer protection against a range of threats.

Behavior-based attacks, which rely on persuading users to behave in an unsafe manner, are more difficult to deal with as they can only be countered by a change in user behavior. The Get Safe Online website provides a number of guidelines for networking safely, including the following:

Don't let peer pressure push you into doing something you're not comfortable with.

Avoid posting information that could identify you, such as telephone numbers, photos of your home, workplace or school, your address, date of birth or full name.

Avoid including personal information in your username, eg: use laughing_boy33, rather than jim_brown.

Set up a disposable email account (eg: Hotmail or GMail) that doesn't look like your real name and use that to register and receive mail from the site.

Use a robust password with eight or more characters.

Don't make comments or post pictures that could prove embarrassing later.

Use the privacy features on the site to restrict strangers' access to your profile.

Beware of phishing scams.

If you ensure that your software defenses are strong and up-to-date and follow the above guidelines you should be able to enjoy surfing on social networking sites without problems.

Parents of young children should ensure that they are not allowed access to the Internet in an unsupervised environment. Even with older children they should try to keep an eye on their Facebook or MySpace profiles and watch out for any changes in behavior which may indicate that they are encountering online problems.