Académique Documents
Professionnel Documents
Culture Documents
Sites
Module 11
Simplifying Security.
CopyrightbyEC-Council
AllRightsReserved.ReproductionisStrictlyProhibited.
May12,2011
CopyrightbyEC-Council
AllRightsReserved.ReproductionisStrictlyProhibited.
CopyrightbyEC-Council
AllRightsReserved.ReproductionisStrictlyProhibited.
Module Objectives
Facebook:SecurityTips
SocialNetworkingSites
StayingSafeonMySpace
WhatisaProfile?
SecurityMeasures
TopSocialNetworkingSites
SocialNetworkingSecurity
Checklist
SecurityRisksInvolvedinSocial
NetworkingSites
SocialNetworkingSecurity
ChecklistforParentsand
Teachers
StayingSafeonFacebook
CopyrightbyEC-Council
AllRightsReserved.ReproductionisStrictlyProhibited.
Module Flow
Introductionto
SocialNetworking
Sites
SocialNetworking
SecurityThreats
StayingSafe
onFacebook
StayingSafe
onMySpace
CopyrightbyEC-Council
AllRightsReserved.ReproductionisStrictlyProhibited.
MySpace(http://www.myspace.com)
Facebook(http://www.facebook.com)
6
CopyrightbyEC-Council
AllRightsReserved.ReproductionisStrictlyProhibited.
What is a Profile?
Profileisacollectionofinformationthat
definesordescribesausersinterests
Themainprofilepageofauserofanysocial
networkingsiteintroducesanddescribesthe
user
Theinformationthatausermayposton
his/herprofileincludes:
FacebookProfile
Names/nicknames
Emailaddresses
Phonenumbers
Photos,videos
Personalinterests
Namesofschools,sportsteams,andfriends
http://www.sophos.com
CopyrightbyEC-Council
AllRightsReserved.ReproductionisStrictlyProhibited.
http://www.tagged.com
http://www.bebo.com
http://twitter.com
http://www.classmates.com
http://www.mylife.com
http://www.myspace.com
http://hi5.com
http://www.friendster.com
http://www.linkedin.com
http://www.myyearbook.com
http://www.myheritage.com
http://www.ning.com
http://www.meetup.com
http://multiply.com
http://www.ebizmba.com
CopyrightbyEC-Council
AllRightsReserved.ReproductionisStrictlyProhibited.
Module Flow
Introductionto
SocialNetworking
Sites
SocialNetworking
SecurityThreats
StayingSafe
onFacebook
StayingSafe
onMySpace
CopyrightbyEC-Council
AllRightsReserved.ReproductionisStrictlyProhibited.
MalwareAttacks
ContactInappropriate
AdultsandBusinesses
IdentityTheft
SiteFlaws
Overexposure
PhishingScams
ObjectionableContent
ContactwithPredators
Attacks on a Social
Networking Sites
10
CopyrightbyEC-Council
AllRightsReserved.ReproductionisStrictlyProhibited.
Cyberbullying
CyberbullyingreferstotheabuseoftechnologytoharassorthreatentheInternetusers
Theinformationpostedonsocialnetworkingsitessuchaspictures,videos,comments,
updatescanbeusedtospreadfalserumors,threatentorevealtheinformation onthe
Internet,harass/blackmailtheuser,stalkingtheuser,etc.
AccordingtoaresearchbythePewInternetProject,39% ofsocialnetworkusershadbeen
cyberbulliedinsomeway,comparedto22% ofonlineteenswhodonotusesocialnetworks
11
CopyrightbyEC-Council
AllRightsReserved.ReproductionisStrictlyProhibited.
Identity Theft
Peopleoftengetcarriedawaywithposting
information ontosocialnetworkingsites
Leftinthehandsofcybercriminals,such
informationcanbeusedtohackintoanonline
servicessecurityquestions,leadingtoidentity
theft
Attackercanalsousetheinformationto
penetrateintothecorporatenetwork ofa
companyofhis/hertarget
Alternatively,theattackermayfindthe users
name,browsethroughhis/hersocialprofile
Hecanthenwriteanemailbasedontheusers
interestsbearingamaliciouslinkordocument
Attacker
User
Maliciousemail
12
CopyrightbyEC-Council
AllRightsReserved.ReproductionisStrictlyProhibited.
Phishing Scams
Socialnetworkingsitescontains
usersinformation liketheemail
addresses,archivedmessages
Thisinformationcanbeusedto
customizeemailmessagesorfake
websites designedsuchthatthe
victimsdiscloseusernames,
passwords,creditcardnumbers,
etc.
IfauserclicksontheUpdate button,he/sheis
redirectedtoaFacebooklookalikephishingsite
Usersarethenaskedtoenterapasswordtocomplete
theUpdateprocedure
13
CopyrightbyEC-Council
AllRightsReserved.ReproductionisStrictlyProhibited.
Malware Attacks
Malwareattacksarecarriedout
throughsocialengineeringasusers
aremostlymisledintoclickingon
maliciouslinks embeddedwithin
personalmessages
Malicioussoftwaregiveattackers
accesstoyourprofile andpersonal
information
Malicioussoftwaremayalsosend
messagesautomaticallytoyour
"friends"list,instructingthemto
downloadthenewapplicationtoo
Anothermethodofattackinvolvesapplications advertisedon
socialnetworkingsites,whichappeargenuine
However,someoftheseapplicationsinstallmaliciouscodeor
rogueantivirussoftware
14
CopyrightbyEC-Council
AllRightsReserved.ReproductionisStrictlyProhibited.
Site Flaws
Therehavebeeninstanceswhensiteflawsinthesocialnetworkingsitesallowthe
informationoftheuserstobeaccessed,eventhoughtheprivacysettingsareset
Suchinformationcanincludemothersmaidenname,oftenusedasasecurityquestion
inonline andreallifesecuritychecks
Serversideflaws
Social
Networking
Sites Flaws
Crosssiterequestforgery
Crosssitescripting
15
CopyrightbyEC-Council
AllRightsReserved.ReproductionisStrictlyProhibited.
Overexposure
Manycommunitypages
maycontainmaterial
thatisnotappropriate
forthechildren
Thechildmaybe
involvedinposting
picturesofhimselfor
herselforoffriendsthat
maybemisused
16
ContactwithPredators
Individualswith
intentiontoexploit
minorsmaycreate
communitypages
pretendingtobeteens
themselves
CopyrightbyEC-Council
AllRightsReserved.ReproductionisStrictlyProhibited.
Module Flow
Introductionto
SocialNetworking
Sites
SocialNetworking
SecurityThreats
StayingSafe
onFacebook
StayingSafe
onMySpace
17
CopyrightbyEC-Council
AllRightsReserved.ReproductionisStrictlyProhibited.
Search
Friendrequests
Messages
FriendList
EducationandWork
CurrentcityandHometown
Likes,activitiesandother
connections
18
CopyrightbyEC-Council
AllRightsReserved.ReproductionisStrictlyProhibited.
19
CopyrightbyEC-Council
AllRightsReserved.ReproductionisStrictlyProhibited.
Profile Settings
SettheprofilesettingsasOnlymyfriendsBydefault,Facebookallowsallofyour
networksandallofyourfriendstobeabletoviewyourprofile
Theusersrevealpersonalinformationtopotentialidentitythievesiftheyleavethisoption
todefaultsettings
Therefore,itisadvisedtoallowyourprofiletobeviewedbyonlyfriends
20
CopyrightbyEC-Council
AllRightsReserved.ReproductionisStrictlyProhibited.
21
CopyrightbyEC-Council
AllRightsReserved.ReproductionisStrictlyProhibited.
22
CopyrightbyEC-Council
AllRightsReserved.ReproductionisStrictlyProhibited.
RecommendedAction
Reason
Allowanyonetoseemy
publicsearchlisting
Becareful
TheusersshouldselecttheoptionYesonlyiftheywant
peopletheyarefamiliarwithtoknowthattheyareon
Facebook
Allowmypublicsearchlistingtobe
indexedbyexternalsearchengines
No
Ifenabled,itallowspeopleusingexternalsearchengines
likeGoogle,YahooandMSNtofindtheuseronFacebook
Seeyourpicture
Becareful
Sendyouamessage
No
Iftheusersrespondtoamessagesentbysomeonethat
theyarenotfriendswith,theunknownuserswillbeable
toviewtheusersprofile
Pokeyou
No
Byrespondingtothepokefromanunknownuser,theusers
willbeallowinghim/hertoviewtheirprofileinformation
foraperiodoftime
Addyouasafriend
Becareful
Viewyourfriendlist
No
Donotsharepicturesthatmayembarrassorthatare
personal
Becautiousbeforeacceptinganyone'sfriendrequest
Theusershouldnotallowpeoplewhoarenotyettheir
friendstoviewtheirfriendlist
23
CopyrightbyEC-Council
AllRightsReserved.ReproductionisStrictlyProhibited.
2. Thinkcarefullyaboutwhoisallowedtobecomeafriend
3. Show"limitedfriends"acutdownversionoftheprofile
Facebookallowsitsuserstomakepeople'limitedfriends'whoonlyhavepartial
accesstotheuserprofile
Thisisusefuliftheusershaveconnectionswhotheydonotfeelcomfortable
sharingpersonalinformationwith
4. Enableaccesstoinformationonlywhennecessary
24
CopyrightbyEC-Council
AllRightsReserved.ReproductionisStrictlyProhibited.
Module Flow
Introductionto
SocialNetworking
Sites
SocialNetworking
SecurityThreats
StayingSafe
onFacebook
StayingSafe
onMySpace
25
CopyrightbyEC-Council
AllRightsReserved.ReproductionisStrictlyProhibited.
26
CopyrightbyEC-Council
AllRightsReserved.ReproductionisStrictlyProhibited.
27
CopyrightbyEC-Council
AllRightsReserved.ReproductionisStrictlyProhibited.
GotoAccountSettings
IM
CheckOnlyMyIM
friends toappearonly
friendsintheIMlist
28
CopyrightbyEC-Council
AllRightsReserved.ReproductionisStrictlyProhibited.
29
CopyrightbyEC-Council
AllRightsReserved.ReproductionisStrictlyProhibited.
Todenyanyunauthorizedaccesstotheprofile:
BlocktheuserbyaddingtheirprofileURLtotheBlockeduserslist
30
CopyrightbyEC-Council
AllRightsReserved.ReproductionisStrictlyProhibited.
Module Summary
Socialnetworkingsitesallowuserstobuildonlineprofiles,shareinformation,pictures,
blogentries,musicclips,etc.
Themainprofilepageofauserofasocialnetworkingsiteintroducesanddescribesthe
user
Cyberbullyingistheprocessofusingtechnologytoharassorbullysomeone
Socialnetworkingsitescontaintheusersinformationlikeemailaddresses,archived
messagesthatcanbeusedtocustomizeemailmessages,orfakewebsites
Malwareattacksarecarriedoutthroughsocialengineeringasusersaremostlymisled
intoclickingmaliciouslinksembeddedwithinpersonalmessages
Setappropriateprivacyandsecuritydefaultsandchooseacomplex/uniquepassword
fortheaccount
31
CopyrightbyEC-Council
AllRightsReserved.ReproductionisStrictlyProhibited.
Becarefulaboutwhatisposted ontheInternet
Becarefulinstallingthirdpartyapplications
Onlyacceptfriendrequests frompeopleyouknow
Onlysharelimitedpersonalinformation
32
CopyrightbyEC-Council
AllRightsReserved.ReproductionisStrictlyProhibited.
Disablethecomments topreventcyberbullying
Donotclicksuspiciouslinkstopreventmaliciousattacks
Updatethecomputerwiththelatestantivirus andothersystem
securitysoftware
Neverinstallcodecswhenasitepromptsyoutodoso
33
CopyrightbyEC-Council
AllRightsReserved.ReproductionisStrictlyProhibited.
Considerkeepingthecomputerinafamilyroomratherthanthechildsbedroom
Instructchildrentoneverrespondtomessagesthataresuggestive,obscene,
belligerent,threatening,ormakethemfeeluncomfortable
Createyourownaccountonthesocialnetworkandspendsometimeonthe
network'ssitetofamiliarizewithsocialnetworkingmedia
Createacheatsheetwithyourchild'spassword,alistofhis/herapproved
friends,andrulesforhowyourchildoperates
Knowchildren'spasswords,screennames,andaccountinformation;thiswillhelp
inmonitoringtheiractivities
Instructyourchildtoaddpeopletotheir"friends"listonlyiftheyknowthemin
reallife
34
CopyrightbyEC-Council
AllRightsReserved.ReproductionisStrictlyProhibited.