What You Say on Facebook Stays on Facebook…Maybe. Lawsuit Accuses Company of Mining Private Messages for Advertisers.

Posted on January 17th, 2014 by Dan Rampe


In mining private messages, has Facebook dug itself a hole? That’s what a federal court is going to have to decide. The question is clear cut. Should a social media user, who pays nothing for the service which earns revenue selling user information to advertisers, have a right to expect his/her information will be kept private?

And, while the question is clear cut, the answer is anything but. Writing on csoonline.com, Antone Gonsalves tackles a case, which one day might end up before the Supreme Court.

The lawsuit filed in federal court in Northern California seeks class-action status for all Facebook users allegedly duped into believing that they could send confidential messages. Specifically, the suit says Facebook has violated the federal Electronics Communications Privacy Act and California privacy laws.

Facebook has allegedly gone wrong by scanning private messages containing links to websites and searching the destinations for clues about the sender that it can sell to advertisers, marketers and other data aggregators.

The plaintiffs argue that Facebook implied the opposite when it launched its integrated email and messaging service in November 2010.

“Facebook telegraphs through the use of the words ‘privately’ and ‘private’ that when a user sends a private message to another party, only the user and the intended recipient will be privy to the contents of that communication,” the suit says.

Plaintiffs Matthew Campbell, Pulaski County, Ark., and Michael Hurley, North Plains, Ore., are seeking the greater of either $100 a day for each day of violation or $10,000 for each affected user, plus damages under California law.

Facebook denies any wrongdoing. “We believe the allegations are without merit and we will defend ourselves vigorously,” the company said in a statement emailed to Computerworld.

Expecting privacy from an ad-driven Web site that needs to check all posted links for malware and spam is ludicrous, Anton Chuvakin, research director for security and risk management at Gartner, said. “Frankly, this is an idiotic suit,” he said. “If the message is really private, as in secret, use encrypted email or hand-deliver it. Why is it on Facebook?”

Of course, the social network has the responsibility of clearly explaining what it does with all user-generated content, so the courts will have to decide whether Facebook was misleading in the use of the word private with its email service.

In the meantime, experts say the suit should remind companies that all business communications should be done through corporate email. Essentially, only information meant to be public should go out on a social network on behalf of the company.

“All social networking companies at this point are making their revenue via advertising and all are using data mining techniques to target ads in one way or another,” Jody Brazil, president and chief technology officer for security management company FireMon, said. “As such, communication must be considered semi-public regardless of how it is posted.”

For easier monitoring of social media use, companies need to have a strict policy that only authorized employees can post content on behalf of the business, privacy expert Rebecca Herold said. In addition, posted content should never contain information about a company’s intellectual property, employees, customers or partners.

“All organizations, in all industries, need to have social media policies in place for not only Facebook, but also for all other social media sites,” Herold said.

ThreatMetrix secures Web transactions against account takeoverpayment fraudidentity spoofing, malware, and data breaches. The ThreatMetrix Global Trust Intelligence Network, which analyzes 500 million monthly transactions, provides context-based authentication and Web fraud prevention to help companies accelerate revenue, reduce costs and eliminate friction. ThreatMetrix protects more than 1,900 customers and 9,000 websites across a variety of industries, including financial servicesenterprisee-commerce, payments, social networks, government, and insurance. For more information, visit www.threatmetrix.com or call 1-408-200-5755.

Join the cybersecurity conversation by visiting the ThreatMetrix blogFacebookLinkedIn and Twitter pages.


Facebook Not Giving Fans a Sporting Chance. Virus Transmitted Via Facebook API Sending Malware to NFL, NBA and Real Madrid FC Fans

Posted on June 27th, 2013 by Dan Rampe


Developers use the Facebook API to create apps for Facebook. Cybercriminals use the same Facebook API to spread malware to Facebook users.

According to an ibtimes.com article by Ryan W. Neal, who says “Facebook is doing nothing to stop (the spread of the malware),” links have been found containing Zeus, a nasty little Trojan generally used to steal from victims’ bank accounts. The targets are NFL, NBA and Real Madrid (Real Madrid Club de Fútbol) fans who use Facebook.

Neal writes, “While not all of the scams are the same, advocacy groups like Fans Against Kounterfeit Enterprise detected that many of these links are serving up malware like Zeus. FAKE (traced the links) back to Russian servers owned by a crime syndicate that specializes in malware, identify theft and child pornography.”

Many of the links purport to have been posted “via Graph API Explorer,” a tool used by developers building Facebook apps. The ibtimes.com story observes programmers use the tool to “query data, create posts, create check-ins and just about everything else one can do on Facebook. There is an even an option to create “Access tokens,” which allow for an app to access a user’s status, groups and many others.”

FAKE’s Eric Feinberg noted that this security flaw made it possible for hackers to dupe people into giving up information by posing as individuals the victims could trust. Ploys hackers used included offering links for buying cheap jerseys or free live streaming video of playoff games. Feinberg thought the solution would be to close off Graph API Explorer. But, so far Facebook has not been inclined to take that action. However, Facebook did block Tor users after a large number of malicious links were found. (Tor is free software and an open network that, in its words, “helps you defend against a form of network surveillance that threatens personal freedom and privacy, confidential business activities and relationships, and state security known as traffic analysis.”)

While Apple OS X and Linux appear to be immune to the malware, Neal warns Windows’ users to be wary of any URL with “tk” in the address as well as anything posted from Graph API Explorer.

ThreatMetrix is the fastest-growing provider of integrated web fraud and cybersecurity solutions. The TrustDefender™ Cybercrime Protection Platform helps companies prevent unauthorized access to web and mobile applications, protect sensitive data, and secure transactions against account takeoverpayment fraudidentity spoofing, malware, and data breaches. ThreatMetrix protects more than 1,500 customers and 9,000 websites across a variety of industries, including financial servicesenterprisee-commerce, payments, social networks, government, and insurance. For more information, visit www.threatmetrix.com or call 1-408-200-5755.

To join in the cybersecurity conversation, follow us on Twitter @ThreatMetrix.