What is Social Spam?

Nothing more than junk posts on your social media sites luring you to click on links that download malicious software onto your computer or mobile device.

Social media (especially Facebook and Twitter) are under assault by social spam. Even Facebook cautions that the social spam volume is growing more rapidly than their user base. The spam-fighting teams at both Facebook and Twitter are growing rapidly. The previous handful of special engineers has seen the inclusion of lawyers, user-operations managers, risk analysts, spam-science programmers and account-abuse specialists. Spammers are following the growing market share, exploiting our web of social relationships. Most of us are ill-prepared to defend against such spam attacks. Here’s how social spam tends to work:

1. Malware infects your friend’s computer, smartphone or tablet, allowing the spammer to access their Facebook or Twitter account exactly as if the spammer were your friend.
2. The spammer posts a message on your friend’s Facebook or Twitter page offering a free iPad, amazing coupons or a video you can’t ignore.
3. You click on the link, photo, Like button (see Like-jacking below) or video and are taken to a website that requires you to click a second time to receive the coupon, video, etc. It’s this second click that kills you, as this is when you authorize the rogue site to download malware onto your computer (not a coupon or video).
4. The malware infects your computer just like it has your friend’s and starts the process all over again using your contacts, your wall and your profile to continue the fraud.
5. Eventually, the spammer has collected a massive database of information including email addresses, login information and valuable social relationship data that they can exploit in many ways. In the process, the malware may have given them access to other data on your computer like bank logins, personal information or sensitive files. In a highly disturbing growth of criminal activity, social malware can actually impersonate users, initiating one-on-one Facebook chat sessions without your consent.

“Like-jacking” involves convincing Facebook users to click on an image or a link that looks as if a friend has clicked the “Like” button, thereby recommending that you follow suit. If our friends Like it, why shouldn’t we. So we click and download in an almost automated response. The key is to interrupt this automatic reflex before we get stung.

Fighting social spam requires immense investments of time, which can mean lost productivity (and money). Gratefully, various company site-integrity teams watch trends in user activity to spot spam. Every day, Facebook says it blocks 200 million malicious actions, such as messages linking to malware. The company can’t prevent spam, but it’s diligently working to make it harder to create and use fake profiles.

But never count on someone else to protect what is yours. You must Own Up to your responsibility. Follow these 5 Steps to Minimize the Risks of Social Spam:

1. If the offer in the post is too enticing, too good to be true or too bad to be real, Don’t Click.
2. If you do click and aren’t taken directly to what you expected, make sure you Don’t Click a 2nd Time. This gives the spammer the ability to download malware to your system.
3. Don’t let hackers gain access to your account in the first place – use strong alpha-numberic-upper-lower case passwords that are different for every site and that you change frequently.
4. Remember, in a world where your friend’s accounts are pretty easily taken over, not all friends are who they say they are. Be judicious. If something they post is out of character, it might not be them writing the post. Call them and verify.
5. Don’t befriend strangers. Your ego wins, but you loose.
6. Make sure you have updated computer security: operating system patches, robust passwords, file encryption, security software, firewall and protected Wi-Fi connection.

John Sileo is an award-winning author and international speaker on the dark art of deception (identity theft, data privacy, social media manipulation) and it’s polar opposite, the powerful use of trust, to achieve success. He is CEO of The Sileo Group, which advises teams on how to multiply performance by building a culture of deep trust. His clients include the Department of Defense, Pfizer, the FDIC, and Homeland Security. Sample his Keynote Presentation (he shares how he lost $300,000, 2 years and his business to data breach) or watch him on Anderson Cooper, 60 Minutes or Fox Business. 1.800.258.8076.

Related posts:

1. Twitter Security Loophole Exposes Your Direct Messages
2. Has Twitter Peaked? Is Privacy Back?
3. Facebook Safety: New HTTPS Facebook Settings

Everyone of us makes impulsively bad decisions (probably not as bad as Weiner, but bad nonetheless). Prior to the internet, you at least had a chance to recover from your past transgressions, as there wasn’t a readily accessible public record of the act unless you happened to be caught on tape (think Nixon, Rodney King, etc.). But now that pretty much every human carries either a camera or video recorder with them at all times (mobile phones), can communicate instantly with a massive audience (Facebook, Twitter, SMS, blogs), and have access to more information than exists in the Library of Congress just by pulling up Google, the equation of how you control sensitive information about yourself has changed radically. Every stranger (and even friend) is like a full service news station with video, distribution and commentary, just waiting to report on your missteps.

Here are three lessons the rest of us can take from the Anthony Weiner affair:

1. Fame raises the bar. Celebrity, for all of it’s glory, puts a spotlight on your conduct. When you get paid for attracting attention, you are bound to attract unwanted attention. Unless your brand consciously involves a rebel persona (Paris Hilton, Lindsey Lohan, Dennis Rodman – in other words, the more trouble you get in, the more money you make), you will be held to a higher standard than those of us who fly under the radar. Fame has its faults. Remember when Gary Hart challenged the press to prove he wasn’t a standup guy? Now everyone who has even the most basic tech tools is an instant paparazzi.
2. Mind the 3 Laws of Posting Online. When you post anything online, what you have published is most often immediately public, permanent and exploitable. You may think that you have a claim to privacy online, but you are deluding yourself. What you upload is only as private as the company or individual housing the data. Once you post, there is no “taking it back”. Weiner removed his tweets quickly, but posts, pictures and videos are backed up, re-tweeted, liked, screen captured and otherwise saved long before you can put a stop to it. Finally, as this case reinforces, what you post online can and will be used against you if it falls into the wrong hands. In Weiner’s case, the wrong hands were those of a political enemy, conservative blogger Andrew Breitbart. Because Weiner chose to make the posts public (even accidentally), Breitbart has a free pass to commit perfectly legal extortion. Before it is all over, the Democratic party will lose one of it’s brightest stars. That is probably a just result, but there is still a question about the forceful nature of the means involved.
3. Admitting fault early and often. If you’ve done something wrong and it is recorded online, “hang a lantern on it” as quickly as possible. This is a phrase that Chris Matthews used in his book on political survival, Hardball. To summarize Matthews position, if you make a mistake and it goes public, admit to it as quickly as possible, take ownership of the wrongdoing and don’t lapse into the web of lies brought on by panic. Hang a lantern on it – expose it to the light, take your lumps and move on. In the end, what will bring Weiner down will likely not be his obscene tweets or explicit photos. Rather, it will be the fact that he blatantly lied about his posts. Had he come clean immediately, he would be judged as a person who made some mistakes just like the rest of us, not as a Congressman who deliberately mislead his constituents.

And there is a larger, more important lesson in all of this. In a world where your every action is subject to capture, publication and mass distribution, it’s far easier to be a moral, upstanding, well-adjusted individual than it is to attempt to hide a dysfunctional dark side. Ultimately, a bit of restraint, discretion and even therapy will be much cheaper than living a double life.

John Sileo speaks, writes and consults professionally on information leadership: managing the exposure of personal and corporate information. His clients include the Department of Defense, Pfizer, Homeland Security and Blue Cross. Learn more at www.ThinkLikeASpy.com or contact him directly on 1.800.258.8076. Expose yourself wisely.

Related posts:

1. 5 Business Survival Lessons from Google’s Spying
2. Harvard Identity Theft Has Lessons for CEOs
3. 7 Steps to Secure Profitable Business Data (Part II)

Think of your move into social media (Facebook/Fan/Business Pages, LinkedIn, Twitter, YouTube, etc.) like you would approach the task of helping your fifteen-year-old daughter prepare to drive on her own. You love her more than anything on earth and would do anything for her (just like you will go to great lengths grow your business), but that doesn’t mean you just hand her the keys. Trying to forbid or ignore the movement into social marketing is like telling your teen that they can’t get their license. It isn’t going to happen, so you might consider putting down the denial and controlling those pieces of change that are within your power. The task is to maximize the positives of her newly bestowed freedom while minimizing any negatives; the same is true in social media.

Here’s a simple plan to follow that will help keep you safe and productive:

1. Understand the Risks & Rewards. Just like you need to know the risks of a teen driving (peer pressure, alcohol, inexperience, inferior equipment), you need to fully understand the risks of operating this powerful piece of equipment we call social media or social networking. Privacy Concerns: Users who fail to customize their Facebook privacy, security and sharing settings are giving away massive amounts of information to other Facebook users, Facebook Vendors (e.g., Farmville), Facebook itself and potentially competitors, thieves and social engineers. Over Exposure: You can share too much on Facebook, including posts, photos and videos that you later regret uploading. If done improperly or without thought, this can lead to increased risk of identity theft, reputation hijacking, burglary or fraud. Reputation Damage: AFLAC fired comedian Gilbert Godfrey as their spokesperson for making a negative comment about the insurance giant on his wall. How you and your employees use social media directly influences your reputation.  Account Takeover: Imagine a pornography crime-ring taking over your fan page for a day. It’s usually not this extreme of a case, but accounts are constantly being compromised and used for nefarious and illegal purposes (sending SPAM, peddling pornography, covering crimes). Just because there are risks doesn’t mean you abandon the medium. It means that you prepare for them, just like training your daughter to drive defensively, break properly on ice and make smart choices about who gets in the car.
2. Define Your Destination. Many businesses that utilize social media don’t actually know why they are using it, other than it’s the thing to do. But using it effectively takes a huge time and knowledge investment, so make sure you define what you want to achieve before you invest. Are you there to make friends, to network, to increase visibility, reshape your reputation or improve customer service? Driving without a destination in mind might be fun, but it will ultimately get you nowhere.
3. Choose the Right Equipment. Once you have defined your objective, you will have a better idea of which social medium to use (Facebook, Fan Page, Twitter, etc.). If your objective is to get your daughter safely from one place to another, you will choose a very different car than if you are trying to enhance her image with friends by buying a sports car. Trying to be part of every last social network means that you will use none of them effectively. Choose one or two platforms and take the time to perform the final two steps.
4. Fasten Your Seat belt. An hour spent understanding and modifying the default privacy and security settings (which are very lax by default) on Facebook or another social site can save you and your organization tragic amounts of data loss and abuse. Our refusal as a society to take this simple, available step to protect our information is the equivalent of not fastening our seat belts while driving. Is it slightly inconvenient and a occasionally uncomfortable? Yes. Does it drastically increase your safety? Without question. With great power comes great responsibility, and we must start communicating that to others around us.
5. Educate Your Driver. This knowledge, from awareness to customization, is only effective if it is passed on to others. You might know how to drive safely, but that doesn’t mean your daughter has picked it up by osmosis. The same is true inside of your organization; it’s not good enough for you do drive safely, the other members of the team must do the same – and not just for their own good, but because it also helps you be safe. After all, just like your daughter will ride in another teen’s car (and you want them to be well trained), your contacts will be handling your data in a social context (think of the picture of you at a St. Patrick’s Day party they consider posting) and need to know how to treat it.

There is nothing gained by ignoring or denying this social movement. It won’t be stopped and you will be part of it, either directly or indirectly. In turn, your business will be affected by how the employees and executives approach and even leverage the energy of social media. If you’re not out there educating your drivers, they are off doing it on their own anyway, seat belt-less and clueless.

John Sileo trains organizations on information leadership, including social media control, identity theft prevention and reputation management. His satisfied clients include the Department of Defense, FDIC, Pfizer and Homeland Security. To bring John in to speak to your organization, contact his staff on 800.258.8076 or watch him entertain audiences with vital content at www.ThinkLikeASpy.com.

Related posts:

1. 7 Steps to Secure Profitable Business Data (Part I)
2. 7 Steps to Secure Profitable Business Data (Part II)
3. 7 Steps to Stem Facebook Privacy Bleeding

Direct messages sent through Twitter can be easily exposed, thanks to a loophole in Twitter’s API, according to Gary-Adam Shannon at Search Engine Watch Reports. When a user logs into another site using their Twitter user name and password, the site can gain access to the private messages, says Shannon. He goes into technical detail, but essentially it’s just a small hack.

Shannon recommends you don’t ever log in to a site (other than Twitter.com, obviously) using your Twitter user name and password. Another writer at Search Engine Watch recommends that users erase their Direct Messages after viewing them.  There has been no comment from Twitter, but we hope they are looking into the issue now that the problem has been made public.

Read more…

John Sileo is the award-winning author of Stolen Lives, Privacy Means Profit and the Facebook Safety Survival Guide. His professional speaking clients include the Department of Defense, the FTC, FDIC, Pfizer, Prudential and hundreds of other organizations that care about their information privacy. Contact him directly on 800.258.8076.

Related posts:

1. Avoiding Social Spam Hackers on Facebook and Twitter
2. Facebook Exposes White House Party Crashers
3. Has Twitter Peaked? Is Privacy Back?

Some believe this slump is due to Twitter’s inability to keep up with its users and others are finding the site less and less useful. Perhaps people are less inclined to put so much personal information on the World Wide Web, knowing that everything you post is public, permanent and exploitable. Or maybe we’re just tired of seeing how boring the average person’s day is.

Click Here to read this entire article.

John Sileo became one of America’s leading Social Networking Speakers & Identity Theft Expert after he lost his business and more than $300,000 to identity theft and data breach. His clients include the Department of Defense, Pfizer and the FDIC. To learn more about having him speak at your next meeting or conference, contact him by email or on 800.258.8076.

Related posts:

1. Twitter Security Loophole Exposes Your Direct Messages
2. Avoiding Social Spam Hackers on Facebook and Twitter
3. Get Ready to Expose Yourself: Deep Packet Inspection is Back

If it seems too good to be true, it probably is.

That is the best way to Think Like A Spy and be alert of Social Engineers that are trying to manipulate you.  With such a gloomy economy and many people without work, offers for fast cash and huge discounts become more and more attractive. Most of these Identity Theft cases use the technique of Social Engineering.

Social Engineering is the act of manipulating people into performing actions or divulging confidential information by playing on their human emotions. The term typically applies to deception for the purpose of information gathering, fraud, or computer system access; in most cases the attacker never comes face-to-face with the victim. These days most thieves can nab your identity over the phone, mail, email, and through social networking sites such as Facebook and Twitter.

While some schemes scam you into giving out social security numbers, bank account numbers or other confidential identity pieces, others are as simple as a pickpocket distracting you emotionally while another thief steals your wallet or purse. Here are what a few of the most widely used savvy cyber attacks look like:

• Phony charitable phishing scams, many of which are designed to look as if they come from real charities. Always enter in the exact URL for the Charity that you wish to donate to rather than clicking on a link.
• Urgent email or text notices from your bank. They tell you to click on a link to access your account to fix an important, time sensitive problem. Don’t click on a link via email. Always type in the exact URL of your your bank or call the number on the back of your card. Nothing is that urgent.
• Nigerian Email Scam. This scam has been around for decades in different versions and states that a wealthy foreigner needs help moving millions of dollars from his homeland and promises a hefty percentage for helping him. This scheme is designed to part you with your money. Once you send a check or bank account numbers you won’t see a dime in return and most victims report losing thousands and hundreds of thousands of dollars to this scam.
• Notices via email, phone, or mail that announce that You Have Won the Lottery! The message usually claims that you will be paid a large sum of money after you pay them a small amount now. Although this is tempting, just say no. Legitimate lotteries don’t ask you pay anything after you have already won.
• Facebook or Twitter distress messages from your friends. If you see a friend asking for money and you are considering helping them out, you should ALWAYS call that friend first. Make sure that their account hasn’t been hacked by a thief.
• Malware-ridden E-cards. It is sad, but true that it is no longer safe to open E-cards. Many contain malware to attack your desktop and gain access to confidential information. Make sure you have updated virus software protection to notify you of viruses that come through emails or the Internet.
• Make fast cash now! AKA: Make thousands a day working from home! All you have to do is send $50.00 for the starter kit. More often than not people will send their $50.00 and never receive anything in return. This scam has become more popular with our nations high unemployment rate.

These are only a few of the many variations of Identity Theft through Social Engineering. Since social engineering often plays on emotions, you should be careful not to get duped during a tragedy or commemorative event. This is when people are in a mood of giving and their emotions run high.  So remember to stop and think about the possible consequences of an offer that may just be too good to be true. Never be afraid to say no!

John Sileo became America’s leading Identity Theft Speaker & Expert after he lost his business and more than $300,000 to identity theft and data breach. His clients include the Department of Defense, Pfizer and the FDIC.  To learn more about having him speak at your next meeting or conference, contact him by email or on 800.258.8076

Related posts:

1. Social Engineering Expert Quoted in CSO Article
2. Fun Social Engineering Training?
3. Credit Card Scams: Celebrities Targeted

Facebook, and social networking sites in general, are in an awkward stage between infancy and adulthood – mature in some ways, helpless in others. On the darker side of sites like Facebook, LinkedIn and Twitter, scammers and identity thieves are drooling at the sight of this unchecked data playground. In contrast, most social networkers are addicted to all of the friendships they are creating and renewing.

There is no denying that Facebook and other social networking sites have a very luring appeal.  You can sit in the comfort of your own home and suddenly have a thriving social life.  You can look up old friends, make new ones, build business relationships and create a profile for yourself that highlights only your talents and adventures while conveniently leaving out all your flaws and troubles.  It is easy to see why Facebook has acquired over 200 million users worldwide in just over five years. Which is why Facebook safety is still so immature: Facebook’s interface and functionality has grown faster than security can keep up.

Unfortunately, most people dive head first into this world of social connectedness without thinking through the ramifications of all the personal information that is now traveling at warp speed through cyberspace.  It’s like being served a delicious new drink at a party, one that you can’t possibly resist because it is so fun and tempting and EVERYONE is having one.  The downside? Nobody is thinking about the information hangover that comes from over-indulgence: what you put on the Internet STAYS on the internet, forever. And sometimes it shows up on the front page of the Wall Street Journal, in the hands of a prospective employer or your boss’s inbox. All of the personal information that is being posted on profiles — names, birth dates, kids’ names, photographs, pet’s names (and other password reminders), addresses, opinions on your company, your friends and your enemies — all of it serves as a one-stop shop for identity thieves.  It’s all right there in one neat little package and all a scammer has to do to access it is become your “friend”.

Follow these Five Facebook Safety Tips and save yourself the trouble…

5 Facebook Safety Tips

Facebook Safety Tip #1: If they’re not your friend, don’t pretend. Don’t accept friend requests unless you absolutely know who they are and that you would associate with them in person, just like real friends.

Facebook Safety Tip #2: Post only what you want made public. Be cautious about the personal information that you post on any social media site, as there is every chance in the world that it will spread beyond your original submission.  It may be fun to think that an old flame can contact you, but now scammers and thieves are clambering to access that personal information as well.

Facebook Safety Tip #3: Manage your privacy settings. Sixty percent of social network users are unaware of their default privacy settings. Facebook actually does a good job of explaining how to lock your privacy down (even if they don’t set up your account with good privacy settings by default). To make it easy for you, follow these steps:

1. Spend 10 minutes reading the Facebook Privacy Policy. This is an education in social networking privacy issues. Once you have read through a privacy policy, you will never view your private information in the same way. At the point the privacy policy is putting you to sleep, move on to Step 2.
2. Visit the Facebook Privacy Help Page. This explains how to minimize all of the possible personal information leakage that you just read about in the privacy policy. Once you understand this on one social networking site, it becomes second nature on most of the others. 
3. Now it is time to customize your Facebook Privacy Settings so that only information you want shared, IS shared. This simple step will reduce your risk of identity theft dramatically.

Facebook Safety Tip #4: Keep Google Out. Unless you want all of your personal information indexed by Google and other search engines, restrict your profile so that it is not visible to these data-mining experts.

Facebook Safety Tip #5: Don’t unthinkingly respond to Friends in Distress. If you receive a post requesting money to help a friend out, do the smart thing and call them in person. Friend in Distress schemes are when a thief takes over someone else’s account and then makes a plea for financial help to all of your friends (who think that the post is coming from you). As with all matters of identity, verify the source.

Following these 5 Facebook Safety tips are a great way to prevent an information-sharing hangover.

The best way to protect you and your children from Online threats is to educate yourself about Facebook, Twitter, MySpace and other online social networking utilities.  We recently published the Facebook Safety Survival Guide (with Parents’ Guide to Online Safety) with that exact goal in mind. Social networking is immensely powerful and is here for the long run, but we must learn to harness and control it.

John Sileo is the award-winning author of Stolen Lives, Privacy Means Profit and the Facebook Safety Survival Guide. His professional speaking clients include the Department of Defense, the FTC, FDIC, Pfizer, Prudential and hundreds of other organizations that care about their information privacy. Contact him directly on 800.258.8076.

Related posts:

1. Social Networking Safety – Travel
2. Online Safety: The Truth About Social Media Identity Theft
3. Cyber-Bullying and Social Networking Identity Theft