Report: Facebook Served As Primary Distribution Channel For Botnet Army
Internet security company NetWitness has just published a report that reveals an 18-month-long widespread hacker attack on computers worldwide whose topmost method of malware delivery was Facebook.
Context & Ripple Effects
This lands at the end of a week in which every other Facebook datapoint pointed upward: Compete told the San Francisco Chronicle that Facebook already sends 13% of US traffic to the big portals, Nielsen measured US usage topping seven hours per month after nearly 10% January growth, and Chamath Palihapitiya used a Mobile World Congress keynote to push the text-only Zero mobile site. The platform's scale is precisely what makes the NetWitness finding uncomfortable.
NetWitness, an internet security company, published research on February 18, 2010 documenting an 18-month-long attack that infected computers worldwide with malware — and identifying Facebook as the topmost delivery method for what it describes as a botnet army. For a company positioning itself as core web infrastructure, being named the primary infection vector by an enterprise security vendor reframes its growth story as an attack-surface story.
First-order effects
- Facebook's security posture becomes an immediate talking point: a confirmed report from a security vendor names its network the leading malware delivery channel, putting pressure on the company's trust-and-safety messaging right as it courts mainstream users and local business pages.
- Corporate IT and security teams evaluating whether to allow Facebook on employee machines gain a vendor-published data point for restricting access, since NetWitness sells exactly the kind of network forensics that surfaces such infections.
Second-order effects
- Security vendors and antivirus providers get a sales catalyst: an 18-month undetected global infection spread through a trusted social network strengthens the case for behavior-based detection over signature-based tools, reshaping enterprise procurement conversations.
- Facebook faces pressure to build or buy URL scanning and malware filtering for shared links, because its core product — friend-trusted content sharing, which the same week's statistics show accelerating — doubles as its largest threat vector.
Third-order effects
- If the largest social graphs keep concentrating web attention and trust, platform operators will be pushed toward treating security infrastructure as a competitive requirement rather than a back-office cost, with regulators eventually following the same logic applied to payments and identity.
- The incident previews a recurring structural tension: distribution channels built on interpersonal trust are inherently attractive to attackers, so the more dominant a social platform becomes, the more its brand absorbs blame for third-party abuse.
The trend: As social platforms absorb the bulk of consumer web traffic and trusted-sharing behavior, they migrate from communication utilities to primary malware distribution channels, forcing platform-level security investment and scrutiny from enterprise security vendors.