As cyber criminals are increasingly targeting Facebook, security issue has became the number one concern on Facebook, and the users or firms that used Facebook for social networking.

As seen in several reports published on the Web recently, the types and severity of the Facebook attacks are expected to be risen in this year 2010.

Here are few reports for your perusal from everything security threats that can open your eyes to a different aspect of the Facebook security issues.

1) Sophos Security Threats Report: 2010 [PDF]

Some excerpts:

According to a Sophos survey conducted in December 2009, 60% of respondents believe that Facebook presents the biggest security risk of the social networking sites, significantly ahead of MySpace, Twitter and LinkedIn.

Source: available at http://www.sophos.com/sophos/docs/eng/papers/sophos-security-threat-report-jan-2010-wpna.pdf, accessed 11 February 2010

Meanwhile, Sophos also said that reports by companies of spam and malware derived from social networks such as Facebook, MySpace and Twitter were up 70 percent from a year earlier.

2) McAfee 2010 Threat Predictions [PDF]

Some excerpts:

With Facebook reaching more than 350 million users, we expect that 2010 will take these trends to new heights.

The explosion of applications on Facebook and other services will be an ideal vector for cybercriminals, who will take advantage of friends trusting friends to click links they might otherwise treat cautiously.

3) Cisco 2009 Annual Security Report [PDF]

Some excerpts:

Social networking site Facebook reports that from August 2008 to December 2009, its active user base more than tripled, from 100 million to 350 million. As Cisco has continued to report, criminals migrate attacks to where their victims are. They have wasted no time targeting this huge audience, and they are creating more sophisticated ways to take advantage of the trust users place in social media. The Koobface worm, first detected on social networking websites such as Facebook in 2008, appeared again in 2009, when yet more variants of the malicious software popped up on Twitter, the microblogging service. Estimates indicate that almost 3 million computers have been infected with Koobface.

Koobface variant is resurfaced again. This time this virus is not only back but with added sophisticated and behaves like an usual Facebook user.

According to TrendMicro, it automates the following routines: Firstly register a Facebook account, and confirm an email address in GMail in order to activate the registered Facebook account. Unlike previous Koobface component, this new Koobface component is joining random Facebook groups, adding Facebook friends and even go further to post messages to Facebook friends’ walls.

Additionally, the profile created by this new Koobface component now appear to be a well-designed and yet completed profile page, with photo, birth date, favorite music, and favorite books, are all filled up in the respective column.

In the meantime, Facebook will need to crack down on the malicious links since the message posted on the Wall by this virus are directed to the usual bogus Facebook homepage or YouTube page hosting the Koobface loader component. For users, the best advice is to be cautious when confirming the friend requests, and don’t simply following the links posted on your Wall.

Source: available at http://www.trendmicro.com/vinfo/images/20091110_koobface_fb.gif, accessed November 10, 2009

Update November 22, 2009: This virus is probably still around as one of my friends’ Wall did appeared a similar message, as shown in the below picture.

Cybercriminals and phishers are still focusing their efforts on Facebook. Several new scam tactics are listed as below.

1) Koobface Variant Resurfaced again

Recent report from CA suggested that a Koobface variant is still actively sending massive spam messages to millions of users on Facebook. During the attack, the Koobface variant connects to the malicious server UPR15MAY.com to acquire information for its spam messages to be sent to contacts of infected users.

2) Killselfz and Ligromind Malware

Similar to the “.at” and “.be” domains, this time the domains used are of the top-level domain. If you come across Facebook messages with phishing links to Killselfz[dot]com and Ligromind[dot]com, do not click on it or else the scammers will plant the malware to your computer.

3) Today, a new wave of phishing attacks on Facebook users is underway. A popular tech news blog Mashable is reportedly discovering two new top-level domains that can steal your Facebook login details and then spam your Facebook friends. If you get Facebook messages which prompt you to click the phishing links to Junfunrun[dot]com and Bulitre[dot]com, stay away from those messages and delete the messages instantly.

If you’re using Windows, you probably have heard of Malicious Software Removal Tool (MSRT). It is a quality antivirus solution to be delivered to the Windows PCs as part of the Automatic Updates package each month.

A good news is that now it’s more safer to use Windows-based PCs to access Facebook as Koobface, a
particularly nasty virus have been included as one of the major virus and worm families being added to the MSRT.

“In working with Facebook, we were able to add detection of Koobface to our Malicious Software Removal Tool (MSRT), which checks computers running Windows software to detect and remove viruses.” Jeff Williams, a Principal Group Program Manager for the Microsoft Malware Protection Center, wrote in a guest post on the Facebook blog.

Meanwhile, the MSRT has also removed Koobface nearly 200,000 times from over 133,677 computers in more than 140 different locales around the world in just two weeks, he wrote.