The most important part of an attack isn't always a vulnerability; sometimes
it's the user's trust.
This was certainly the case during an authorized
penetration test at an energy company conducted by security
vendor Netragard. Looking for a way inside the customer's
defenses, the vendor turned to Facebook. Testers built a profile claiming
to be of an employee of that company, bolstered it with information on
work experiences taken from actual employees of the energy company and began "friending."
What the Facebook "friends" didn't know was that this was all part
of a long con—a bit of social engineering used to lull the employees
into giving up their credentials more easily. The simulated attack underscores
both the importance of having sound policies on employee
use of sites like Facebook, LinkedIn and MySpace and the challenges of
authenticating users on the Web.
"Before the advent of social networks, criminals were able to access
your employees through things like spam, or maybe they could call them up and
social-engineer them," said Adriel Desautels, CTO
of Netragard. "But sites like Facebook and MySpace and LinkedIn and all
these different sites [give] criminals the ability to bypass just about any
security technology you have in place and gain direct social access to your
employees."
Online Media 
