One of the basic rules of IT security is, as soon as an application or platform becomes popular, criminals are going to target it for malicious purposes.  FaceBook is no exception:  it’s recently been hit with a several rogue applications that try to lure users to phishing sites.

The apps themselves look innocuous, but if installed on a user’s account can set off a chain of events designed to lure friends to phishing sites.  If a friend tries to access the app, it phishes for their username and password, which is then stored and forwarded to the gang behind the app. 

So if you’re using FaceBook, be careful about apps forwarded to you by friends:  they may not have intended to send it to you, and it may not be friendly.  And if the app behaves suspiciously, asking you for additional details such as your username or password, then it probably is suspect.

Two researchers at Carnegie Mellon University in the US have recently shown how a single piece of information can be used to commit identity theft, with a little unwitting help from the US Government.

The research has shown how to reverse-engineer an American citizen’s Social Security number (the key piece of ID data that lets an individual apply for driving licenses, credit cards, etc.) using nothing more than data from publicly available government sites, and the data users share with the world on Facebook.

They developed an algorithm which could guess the first part of the Social Security number, which is based on an individual’s date and state of birth, to 90% accuracy.  The remaining digits could then be cracked by random number generation, and then checked for accuracy in name and state against FaceBook listings.

It’s an excellent example of how a determined organisation or person could find and use information that could compromise sensitive data.  All the more reason to keep your data secured wherever it is.