Updated Sept. 8 with National Geographic saying the app is not sanctioned by them.
Researchers have created a proof-of-concept application for Facebook that turned the machines of people who added the app to their Facebook page into elements of a botnet that in a demonstration launched denial-of-service attacks on a victim server.
"Social Network Web sites have the ideal properties to become attack platforms," according to a paper entitled "Antisocial Networks:Turning a Social Network into a Botnet," that was authored by five researchers from the Institute of Computer Science in Greece and one from the Institute for Infocomm Research in Singapore.
The demo application, called "Photo of the Day," displays a new photo from National Geographic every day. However, every time someone views the photo, the host computer is forced "to serve a request of 600 Kbytes," according to the paper.
A National Geographic spokeswoman said the app is not sanctioned by her company.
Such a botnet could be used for other types of attacks, such as spreading malware, scanning computers for open ports, and overriding authentication mechanisms that are based on cookies, the paper warned.
The researchers suggested that Facebook and other social networks be careful in designing their platform and application programming interfaces (APIs) so that there are few interactions between the "social utilities they operate and the rest of the Internet."
"More precisely, social network providers should be careful with the use of client side technologies, like JavaScript, etc," the paper says. "A social network operator should provide developers with a strict API, which is capable of giving access to resources only related to the system. Also, every application should run in an isolated environment imposing constraints to prevent the application from interacting with other Internet hosts, which are not participants of the social network. Finally, operators of social networks should invest resources in verifying the applications they host."
In addition, the apps pose privacy risks as well because of the access they have to the data of the people who add the apps to their pages, the paper says.
Similar privacy and security concerns have been raised by others after previous third-party apps have been found to have security holes in Facebook.
Facebook representatives did not return e-mails seeking comment.
(Via ZDNet's Zero Day blog and the Dark Reading blog.)
The Georgian embassy in the U.K. has accused forces within Russia of launching a coordinated cyberattack against Georgian Web sites, to coincide with military operations in the breakaway region of South Ossetia.
Speaking to ZDNet UK on Monday, a Georgian embassy spokesperson said that Web sites had been unavailable over the weekend, claiming this was due to Russian denial-of-service attacks.
"All Georgian Web sites have been blocked," said the spokesperson. "Georgia is working on redirecting Web traffic."
At the time of writing, the Web site for the Ministry of Defense of Georgia was unavailable for viewing from the U.K. The Web sites for both the Georgian presidential office and the Ministry of Foreign Affairs of Georgia were available, but the spokesperson said this was due to Georgian redirection work.
"They are new (Web sites)," said the spokesperson. "It was impossible two days ago (to access them)."
However, the spokesperson acknowledged that, as yet, Georgia could not confirm that Russia had been responsible, as the causes were still "under investigation." But the spokesperson asked: "Who else might it be, though?"
In 2007, disruptions of Internet service in Estonia--like Georgia, formerly a political division of the Russia-dominated Soviet Union--prompted talk of those events as possibly the first-ever cyberwar. The exact nature of the disruptions, and who might be to blame, proved hard to pin down.
The Russian embassy in London said it had no information regarding cyberattacks against Georgia, but insisted there had been no military attack against Georgia. "I'd like to draw attention to a misunderstanding," said a Russian embassy spokesperson. "There is no Russian (military) attack. There is peace enforcement in South Ossetia."
According to a post on the Web site of the president of Poland, Lech Kaczynski, the Russian government blocked Georgian Web sites to coincide with "military aggression."
"Along with military aggression, the Russian Federation is blocking Georgian internet portals," read a statement on the Polish presidential Web site. "On request of the president of Georgia, the president of the Republic of Poland has provided the Web site of the president of Poland for dissemination of information."
One of the statements made by the Georgian government on the Polish presidential Web site accused the Russians of bombing the port of Poti on the Black Sea, "far from South Ossetia," and of sending warships into the area.
"(Poti) serves as a vital energy-transit route to Europe," read the statement. "Over the past 48 hours, Russian forces have killed over 100 Georgian civilians and soldiers, after targeting residential complexes in Georgia, as well as airports, bases, and other vital infrastructure."
A "full cybersiege"?
The RBN Web site, which normally attempts to track the activities of the criminal Russia Business Network, kept a running commentary of technical developments over the weekend.
On Saturday, the RBN blog, which is run by security researcher Jart Armin, claimed there was a "full cyber-siege" of Georgia. The RBN blog post claimed that the Russia-based servers AS12389 Rostelecom, AS8342 Rtcomm, and AS8359 Comstar were controlling all traffic to Georgia's key servers.
According to the blog, German hackers managed to route traffic directly to Georgia through Deutsche Telekom's AS3320 DTAG server for "a few hours" on Saturday, but this traffic was intercepted and rerouted through AS8359 Comstar, which is located in Moscow.
The RBN Web site also warned users not to trust any Web sites that appeared to be maintained by the Georgian government but did not have any statements about the weekend's hostilities, as these had likely been intercepted and altered.
Security organization the Shadowserver Foundation reported in an update to an earlier blog post that it was also seeing cyberattacks directed against ".ge" sites, with the Georgian Web sites being hit with HTTP floods. Shadowserver reported that the command-and-control server being used to launch the attacks was located in Turkey.
In July, Shadowserver security volunteer Steven Adair reported that the president of Georgia's Web site had suffered a denial-of-service attack following a buildup of hostilities between Russia and Georgia over South Ossetia.
Tom Espiner of ZDNet UK reported from London.
Background information provided by CNET's Rob Vamosi
- prev
- 1
- next
