Loudmouth workers leaking data through social networking sites

Twitter ye not


Almost two-thirds (63 per cent) of sys administrators fear that workers share too much personal information through social networking websites, according to a poll by IT security firm Sophos.

Blabby workers are putting corporate infrastructure and data at risk, according to the survey, which also found that a quarter of organisations got hit by spam, phishing or malware attacks via sites such as Twitter, Facebook, LinkedIn and MySpace.

These social networking sites have become a favourite locale for cybercrooks bent on stealing identities, distributing malware or sending spam.

"The initial productivity concerns that many organisations harboured when Facebook first shot to popularity are giving way to the realisation that there are more deliberate and malicious risks associated with social networking," said Graham Cluley, senior technology consultant at Sophos.

Although one third of organisations still reckon timewasting on social networking sites is the greater issue with sites such as Twitter and Facebook, malware and data leakage were also cited as concerns by many firms.

Attacks on social networking sites over recent months have run the gamut, from scams designed to trick users into sending money to exotic locations under the pretence that a friend is in trouble, to malware disguised as Facebook error messages. Often hackers obtain access to profile using phishing techniques before using these compromised accounts.

The Sophos survey found that one third of respondents has received spam through social networking sites, while one in five (21 per cent) have been the victim of targeted phishing or malware attacks.

Sophos reckons that regulating - rather than proscribing - access to social networking websites is the way to go. "The danger is that by completely denying staff access to their favourite social networking site, organisations will drive their employees to find a way round the ban – and this could potentially open up even greater holes in corporate defences," explained Cluley.

"Let's not also forget that social networking sites can have beneficial business purposes for some firms too, giving them the chance to network with existing customers and potential prospects." ®

Broader topics


Other stories you might like

  • Musk repeats threat to end $46.5bn Twitter deal – with lawyers, not just tweets
    Right as Texas AG sticks his oar in

    Elon Musk is prepared to terminate his takeover of Twitter, reiterating his claim that the social media biz is covering up the number of spam and fake bot accounts on the site, lawyers representing the Tesla CEO said on Monday.

    Musk offered to acquire Twitter for $54.20 per share in an all-cash deal worth over $44 billion in April. Twitter's board members resisted his attempt to take the company private but eventually accepted the deal. Musk then sold $8.4 billion worth of his Tesla shares, secured another $7.14 billion from investors to try and collect the $21 billion he promised to front himself. Tesla's stock price has been falling since this saga began while Twitter shares gained and then tailed downward.

    Morgan Stanley, Bank of America, Barclays, and others promised to loan the remaining $25.5 billion from via debt financing. The takeover appeared imminent as rumors swirled over how Musk wanted to make Twitter profitable and take it public again in a future IPO. But the tech billionaire got cold feet and started backing away from the deal last month, claiming it couldn't go forward unless Twitter proved fake accounts make up less than five per cent of all users – a stat Twitter claimed and Musk believes is higher.

    Continue reading
  • Azure issues not adequately fixed for months, complain bug hunters
    Redmond kicks off Patch Tuesday with a months-old flaw fix

    Updated Two security vendors – Orca Security and Tenable – have accused Microsoft of unnecessarily putting customers' data and cloud environments at risk by taking far too long to fix critical vulnerabilities in Azure.

    In a blog published today, Orca Security researcher Tzah Pahima claimed it took Microsoft several months to fully resolve a security flaw in Azure's Synapse Analytics that he discovered in January. 

    And in a separate blog published on Monday, Tenable CEO Amit Yoran called out Redmond for its lack of response to – and transparency around – two other vulnerabilities that could be exploited by anyone using Azure Synapse. 

    Continue reading
  • Microsoft fixes under-attack Windows zero-day Follina
    Plus: Intel, AMD react to Hertzbleed data-leaking holes in CPUs

    Patch Tuesday Microsoft claims to have finally fixed the Follina zero-day flaw in Windows as part of its June Patch Tuesday batch, which included security updates to address 55 vulnerabilities.

    Follina, eventually acknowledged by Redmond in a security advisory last month, is the most significant of the bunch as it has already been exploited in the wild.

    Criminals and snoops can abuse the remote code execution (RCE) bug, tracked as CVE-2022-30190, by crafting a file, such as a Word document, so that when opened it calls out to the Microsoft Windows Support Diagnostic Tool, which is then exploited to run malicious code, such spyware and ransomware. Disabling macros in, say, Word won't stop this from happening.

    Continue reading

Biting the hand that feeds IT © 1998–2022