if you join any of these networking services, make sure to select the option in the settings so your profile is NOT accessible via the major search engines. here’s why: (from MSNBC last wk)
—
Almost everyone forgets a Web site password once in a while. When you do, you click on the familiar “Forgot your password?“ link and, after entering your pet’s name, identifying your high school mascot or answering some other seemingly obscure questions, you can get back into your account.
But there’s a problem: A criminal can do that, too. With the help of social networking sites like Facebook and MySpace, personal trivia is getting less obscure all the time. You’d be surprised how easily someone can uncover Fido’s name or your alma mater with a little creative searching.
Some security researchers are beginning to sound the alarm about “password resetting” tools, suggesting they could be the weakest link in Web security.
As an experiment, Herbert Thompson, chief security strategist of People Security, recently asked a few friends for permission to “hack” into their bank accounts. Using only information gathered from Web sites, Thompson found his way in within minutes.
“This is a serious problem. It kind of blew me away,“ Thompson said.
Here’s what Thompson did. Using only one friend’s name and place of employment, he found her blog and résumé. That provided a font of information on her grandparents, pets, hometown and more. He then visited her bank’s Web site, where her user name was simply her first initial and last name. He asked for a password reset. The bank sent an e-mail with that information to her Web mail account. Thompson then asked for a password reset there, which sent a link to her old college e-mail account. There, Thompson needed only supply the woman’s address, zip code, and birth date. Once successfully in the college account, Thompson hacked his way into the Web mail account – supplying her birthplace and father’s middle name—and ultimately entered her bank account by supplying her pet’s name.
“I did this a couple of times. But the scariest thing would be someone doing this with some scale,“ Thompson said. A more detailed description of his romp through someone else’s identity can be read on the Scientific American Web site.
There are no known cases in which hackers have widely exploited “forgot your password” links, but there are indications that both researchers and criminals are training their eyes in this direction. Markus Jakobsson, principal scientist at the famed Palo Alto Research Center in California, said answers to password reset questions have become so valuable that a black market has developed for personal information like dog’s names. Criminals buy buckets of personal information, obviously with an eye towards foiling security systems, for about $15 per set, he said.
In most cases, such information sets are probably the result of successful phishing attempts, Jakobsson said, where a victim unwittingly supplied personal information in response to an e-mail. But he’s seen demonstrations of far more sophisticated tools designed to “scrape” information off blogs and social networking pages for later use by hackers.
“It’s an automatic dossier building tool,“ he said.
