Inside Facebook

Security firm Trend Micro has just published details on a new variant of the Koobface worm that spread on Facebook earlier this year, this time more specifically designed to imitate the behavior of Facebook users. It’s a slightly more sophisticated approach than some of the previous attacks we’ve seen. According to the report, the new Koobface component automates the following actions:

• Registering a Facebook account
• Confirming an email address in Gmail to activate the registered Facebook account
• Joining random Facebook groups
• Adding Facebook friends
• Posting messages to Facebook friends’ walls

The messages posted to Facebook walls contain the usual link that goes to fake Facebook or YouTube pages where the worm spreads. Trend Micro doesn’t have details on how widespread this new component is, but we expect it’s pretty small. Users can avoid the problem by not clicking on suspicious looking links from unknown people on Facebook.

Facebook’s site integrity teams are constantly battling security threats like these from phishing sites to Koobface worms with automated detection systems that remove the fake accounts and delete the malicious links. We don’t know the specific number of Facebook accounts affected by these kinds of security issues, but Facebook has told us before that the number is under 1%. The company has also been fighting phishers in court, and recently won a $711 million judgment against “Spam King” Sanford Wallace.

Given that over 325 million people use Facebook every month, growing to an estimated 375 million by year’s end, it’s no surprise that spammers are attracted to the site. Facebook must continue to both enhance its automated systems and educate users about the tactics spammers employ, as preserving user trust is absolutely vital to its future.