Facebook Boosts Security After Dual Phishing Attacks
Facebook has brought in some soldiers to fight the war against malware and phishing scams on the social-networking site. After two different malware attacks this week, Facebook announced it would begin using San Francisco-based …
Context & Ripple Effects
Facebook had expanded third-party access in the days before the attacks, opening parts of its code for applications around status updates, photos and links and announcing Open Stream APIs. The phishing incidents put the security burden of that more permeable platform architecture into focus.
The episode also lands amid analyst criticism of Facebook's privacy settings, making account protection a trust issue as well as an operational one.
First-order effects
- Facebook must deploy enhanced protections for users and administrators targeted by the two malware and phishing campaigns.
- Group owners face heightened exposure because phishing attempts have targeted owners of large Facebook groups, a particularly valuable account class for attackers.
Second-order effects
- Facebook's developer-access expansion will require tighter scrutiny of how applications and shared content can be used to direct users toward fraudulent pages or malware.
- Privacy and security controls become linked in Facebook's user-trust proposition: weak account protection compounds concerns about users' ability to control their information.
Third-order effects
- If social platforms continue opening application interfaces while attracting phishing campaigns, security enforcement will become a core constraint on how broadly they can extend third-party access.
- The incident points toward identity and account-integrity safeguards becoming competitive infrastructure for social networks, rather than a reactive feature added after abuse.
The trend: Social networks are broadening developer access while being forced to build stronger account-security controls around the resulting trust boundary.