Stalking Privacy on Facebook, One Psycho at a Time

by John Fontana

If you were asked who could harvest a trove of personal data from 10 million Facebook users in just three weeks you might guess company CEO Mark Zuckerberg over Jason Zada. You'd be dead wrong.

Who is Zada? He offered something scary at Halloween and nearly 10 million strangers stepped up and provided him access to their personal Facebook information to get it. Unwittingly walking him past their privacy settings and into their policy-protected data vaults. Maybe you were one of them?

Certainly more than 10 million people viewed Zuckerberg's private photos a few weeks ago when a Facebook bug exposed them to the public. But Zuckerberg was hacked, Zada's millions were socially engineered, accomplices in their own fleecing.

What sophisticated tool did he use? Facebook Apps.

Zada was the creator of TakeThisLollipop.com, a viral Facebook app that collected your Facebook pictures and profile information and put it in the middle of a psycho stalker video.

It was hailed as brilliantly scary. The video ends with the psycho getting out of his truck at a house. Your photo taped to his dashboard. Zada said it was a message about privacy.
"If you look at the video, the scariest part is that your information is in the video. The piece is scary because a person is violating your privacy, not because it's bloody or there's anything jumping out," he told AdAgeDigital.

Actually the scariest part is that your information is in the hands of the Facebook application developer - in this case Zada, who it turns out is benign. His intent was to entertain and his app clearly stated it was not saving your information. But what's to stop a real life psycho from doing the same thing and saving the data? Nothing really.

Facebook has a set of usage policies for its Facebook Platform, which is what developers use to create apps. Among other requirements, the policies dictate application owners must delete all user data if they stop using the platform or Facebook shuts down their app. And policy says app developers must 'delete all data you receive from us concerning a user if the user asks you to do so.'

If developers are running a business, policy means something. If you're running a scam, policy talk is cheap.

How can a real-life psycho (or scammer, phisher) get your 'protected' data? Ironically, exactly the same way Zada did.

Set-up an app that lets users grant you access to their data, show them a video or offer a game, collect their information, stalk in real life.

In Zada's video you see the psycho is looking at a map to your house. Where do you think that information came from?

What Zada proved is that the Facebook stalker scenario is real-life. The potential psychos you block via privacy settings know your back door is unlocked. A scam would likely run the same as TakeThisLollipop. It sprung up on the Internet, went viral and disappeared in 20 days.

Could it have been sleuth hackers, the Russian mafia, the cliché computer hermit in his parent's basement?

It's an email phishing scam mimicked on the social web. It relies on user habit and social engineering - surfing, prurient interest, etc.

Do users know (or care) Facebook apps by-pass privacy settings? One developer I spoke to said after he wrote his first Facebook app he revoked access to every Facebook application he had signed on to. He was dumbstruck by the amount and depth of user information his app made available to him. When he tested it against his own Facebook account, no matter how tightly he screwed down his privacy settings, the app still had access to just about everything it requested.

TakeThisLollipop.com proves that a fool and his password (and data) are soon parted. Facebook is a ripe audience; unwittingly picked apart.


original article found here

What Happens Online Stays Online?

By Robert Weiss LCSW, CSAT-S

Today’s omnipresent fear that one’s personal identifying data (e.g., social security number or credit card information) may be vulnerable to hackers and identity theft has pushed millions of subscribers into the arms of “identity theft protection” companies like LifeLock.

But is anyone really paying attention to what will happen when the sexually explicit language and photos that are sent via the latest “friend finder” smart-phone app or sex website get hacked or otherwise exploited?

When “joining” sites like Ashley Madison or downloading apps like Blendr, participants are offered some measure of comfort via a click-it guarantee that personal information will be securely maintained. But somehow it seems off the radar to the same professionals and/or married individuals, who would never send their social security number online via an unsecured site, that when you sext and arrange app-based sexual hook-ups, every word and pic sent via these apps also resides in a far-away server. And that information lives there for a whole lot longer than the instant it takes to sext a potential hook-up.

What happens to all the intensely personal, intimate sexual imagery and language now housed in the servers of companies like Ashley Madison (currently reporting over 9 million members), Adult Sex Finder and Grindr, to name just a few, if these business are bought out, go under or just plain get hacked? If recent news stories are any indication, online sexual activity isn’t nearly as private as many may naively believe:

Last month, Grindr, a popular smartphone app that enables gay men to meet other gay men using their phone’s GPS, was compromised by a Sydney hacker, who then placed users’ personal chats, explicit photos and private information online. This app currently has more than one million users worldwide. Security experts warn that the same vulnerabilities are present in other hook-up apps such as Blendr (the straight version of the app) and Ashley Madison.

Last week, a young man affiliated with hacker group Anonymous claimed to have hacked into a website operated by pornography provider Brazzers. The emails, usernames and other personal information of more than 350,000 users may have been exposed, a small sample of which were posted publicly online.

Anonymous has also just claimed responsibility for taking down the CIA website. Previously, the group took aim at the FBI, the Department of Justice, entertainment companies and the Church of Scientology, among others. Similar groups have targeted the U.S. Census Bureau, Interpol and various state public safety departments.

Over 20 years as a specialist in the field of adult intimacy disorders and sexual addiction has taught me (and you can see it clearly in the film Shame), that those intellectually stable, but emotionally challenged adults with problem patterns of sexual behavior can and do destroy their careers and tear apart their relationships without meaning to do so. All the while they believe they were somehow “safe” from being found out.

Unfortunately nearly all of these men and women prior to getting help expressed feeling when they are in the pursuit or “bubble” of their sexual and romantic highs that:

• They are “in control” and “know what they are doing”
• “No one will ever know or find out” if they’re “careful”

I need only cite Fmr. Congressman Anthony Weiner as one of the many unfortunate examples of this type of denial. And there are many more such individuals with stories in and out of the media nearly every day.

As technology becomes more intimately threaded into our lives, perhaps we need to broaden our ideas about what is truly “private” and what can be readily uncovered and shared in a public forum. If not, when the day comes (and it will) that the personal data currently maintained by any of the friend-sex-finder websites/apps are exposed and posted on a U.S. website, the Anthony Weiner sexting story, his subsequent marital separation and congressional resignation are going to look like a Girl Scout party by comparison.

Robert Weiss is the author of three books on sexual addiction and Founding Director of the premiere sex addiction treatment program, The Sexual Recovery Institute. He is Director of Sexual Disorders Services at The Ranch and Promises Treatment Centers. These centers serve individuals seeking sexual addiction treatment, love addiction treatment, and porn addiction help. Specifically, the Centers for Relationship and Sexual Recovery at The Ranch (CRSR) offer specialized intimacy, sex and relationship addiction treatment for both men and women in gender-specific, gender-separate treatment and living environments.

original article here

In Just One Hour Online...

It took just one hour for internet experts to find out almost every private detail of one woman's life

Steve Boggan challenged web experts to see how much they could discover about his partner. The results were chilling...

As I sit writing this, I am feeling vaguely grubby — guilty even — in the way a neurotic husband might after hiring a gumshoe to go trawling through his wife’s secrets.

There is a 15-page report in front of me chronicling virtually every aspect of my girlfriend’s life: past and present. That includes her friends, education, embarrassing pictures, former boyfriends and long-forgotten relatives.

Much of the information is new to me. And the uses to which it could be put — uses I hadn’t dreamt of until this week — are chilling.

Armed with this information, criminals could use her identity to commit fraud or resurrect minute details of her past, her movements and friendships to lure her into scams or even dangerous liaisons.

It could be used to con her into revealing her bank details and credit card numbers.

My internet snooping began because the CEO of Google, Eric Schmidt — a man not known for worrying about internet surfers’ privacy — suggested recently that young people might want to change their identities in the future in order to separate themselves from a past lived too openly on the internet.

We all know Facebook pictures of you dancing at a party with a traffic cone on your head might come back to haunt you. But change your identity completely?

Surely, I wondered, there isn’t enough out there to warrant that.

So I decided to find out how much I could discover about my partner of 12 years, Suzanne, just by using the internet.

Before you think I’m a rat, I should point out that Suzanne, a 39-year-old with a soft furnishings business, agreed to it.

I began in the way lots of identity thieves do: with her name and address. Of course, I knew these details, but identity thieves often discover them by ‘dumpster diving’: looking through dustbins for a discarded piece of mail.

I passed Suzanne’s name and address — but no other details — to Adam Laurie, a 48-year-old computer security and internet privacy advocate.

He shared the information with Chris Sumner, 39, another security expert, who works for a multi-national corporation.

Or at least, that is Sumner’s day job; by night, he analyses vast amounts of information publicly available on the internet to see what it can tell him about criminal activity — in this case, how fraudsters are using social networking sites to choose their victims.

Using sophisticated and completely legal computer techniques, he looks for patterns in the behaviour of internet users to uncover otherwise hidden links.

In the case of social networking sites, he can see just how close two people, or groups of people, really are to each other.

He had met neither me nor Suzanne and knew nothing of her existence until given her name and address.

A day later, his findings dropped into my email inbox.

Picking Suzanne’s life apart, he told me, had taken him just over an hour.

This is because, in common with millions of people in Britain, Suzanne uses the social networking sites Facebook and Friends Reunited, and has signed up to the business networking site LinkedIn and Flickr, the photo-sharing website.

By also using the genealogy website ancestry.co.uk, Sumner was able to piece together the names of all but one of Suzanne’s relatives, including cousins.

Using electoral rolls on 192.com and by searching on Google, he found the addresses of her parents and lots of her friends and colleagues.

From her LinkedIn and Facebook profiles, he found the names of Suzanne’s primary and secondary schools, and a college she had attended in Derby. He also discovered she had studied fine art at Central St Martin’s College of Art & Design in London.

He also had details of Suzanne’s qualifications and pictures of her from her days at school. The snaps weren’t hers — an old schoolfriend had put them on Facebook.

There were some naff hairstyles, but that was as deep as the embarrassment went. Only you know whether a trawl of pictures of you would be more damaging.

But Sumner didn’t stop there. He was able to tell me that Suzanne had travelled extensively in Europe, Asia, the Caribbean and the South Pacific.

This was because she had used an application on Facebook that linked to the travel website TripAdvisor. You fill in where in the world you have been to keep your relatives up to date. But anyone can see it.

He was not only able to list all 41 countries she had visited, but also the 162 towns and islands to which she had been.

Sumner was able to tell me Suzanne’s exact movements by cross-referencing her TripAdvisor entries with photographs she had posted on Flickr.

When you click on a picture on Flickr, a small box gives you access to detailed information that is entered not by you, but by your camera. So, the date and time of the shot are included.

Now that phones and cameras have GPS, there are even concerns that the location of where you uploaded the picture — normally where you live — might be visible.

From a mixture of all of these websites, Sumner listed Suzanne’s likes, dislikes, hobbies, the 34 towns and cities she had visited in Britain, the places where she used to socialise in her youth and details of her former jobs in the newspaper industry.

In fact, it’s fair to say that after just one hour’s trawling he knew more about many aspects of my girlfriend’s past than I did.

Shocking? Perhaps. Yet also astonishingly easy. Suzanne had voluntarily signed up to these websites and, bit by bit, put most of this information out there herself — and forgotten much of it.

However, what I found even more disturbing is that much of what Sumner found was supposed to have been visible only to people whom Suzanne had accepted into her inner circle of ‘friends’ on each networking website. This turned out to be dangerously naive.

Over the years, standard privacy settings— notably for Facebook — have changed, so what you once thought was private has become public.

You are notified about these changes, but if you forget to adjust your individual settings to return to the old level of privacy (which can be fiendishly complicated) then some of your private information becomes available for everyone to see.

‘There are some weird, strange quirks that let you into places you aren’t supposed
to go,’ says Sumner.

‘For example, on Facebook you may not be allowed to see someone’s photographs because they’re private. But if they post a message with one of their photos attached, you are given the option of seeing their whole album. And as you can imagine, that can be embarrassing.’

According to Sumner and Laurie, organised criminals are using this information
in increasingly sophisticated ways to target victims.

‘Criminal gangs are carefully fishing for victims,’ says Laurie. ‘In the past, they would have sent out thousands and thousands of spam emails in a scattergun fashion — and many still do.

‘These are called phishing scams and involve fake requests from banks asking
people to confirm their account details, passwords and so on. The hope is that, once in a while, someone would be silly enough to reply.

‘Today, they are much more targeted. For example, with the information we got about Suzanne from Flickr, you would be able to see where she visited, when, and, if there were captions on the pictures, with whom.

‘After that, the criminals (or romance scammers) would tailor a scam. If they noticed that, say, she was a regular visitor to Malawi, they would make an introduction online, claiming they were a friend — for example, called Dave — of someone she visited there with five years ago.

‘Surely she remembers them? From that beach — her friend was there, too ... yes?

‘Usually people are too embarrassed to say they don’t remember. Then ‘‘Dave’’ claims he is setting up an orphanage — would she like to make a contribution towards it?

‘Or they might simply say they’re a friend of a person you were with and say he’s gone back there, broken his leg and they’re having a fund-raising collection to airlift him home. It’s crude, but effective.’

Sumner says it can get even more complex, with software tools that can work out who is friends with whom among your online groups of contacts.

‘Once you have established a person’s inner network, you go back into their history to find someone they knew at school who isn’t in that network of close friends and who hasn’t signed up to networking sites,’ he says.

‘Then you join those sites in their name, establish yourself with their online identity and ask your original target to accept you as a friend on, say, Facebook.

‘Before you know it, you are inside their life as a trusted person they think they used to know.

‘Once you are in, you can read about what your target and their friends are up to, such as when they are going on holiday. With that information, you can burgle their homes.

‘You can even ask to be Facebook friends with their children. This is a particularly frightening way for someone to stalk you or your family. They can introduce themselves as a Facebook friend of Mum or Dad. And then it’s only a couple of steps away from something awful happening.

‘Teenagers, in particular, are very indiscreet and post hundreds of pictures of themselves, sometimes drunk with their friends in the living room in front of the plasma screen TV or home cinema.

‘Not only are these the sort of pictures that will come back to haunt them in the future — potential employers aren’t supposed to look at these, but they do — but it’s also a dumb way to show burglars what property you have and where it is.

‘Especially after your children have told all their “friends” when the house is going to be empty.’

Sumner described how some of the information he gained from Suzanne would have helped him to get hold of her bank and credit card details. I won’t reveal exactly how he did it, but it involved using some of her social networking information to gain her confidence, then posing as a friend and asking if her business would make some curtains for him with a sample of material he’d seen on another website.

The catch would be that he had set up that other website himself and when she visited it some rudimentary programming he had installed would help him acquire her credit card details.

I ask Suzanne if she would have fallen for the scam. ‘It’s hard to know, but based on what he said, why wouldn’t I have gone along with the requests of a potential customer?’ she says.

There are other ways, too, that criminals can use personal information harvested from the internet. For example, people often use the names of their children or
pets as passwords for online shopping sites.

If criminals can find these names, by gaining access to your social networking circle, they can try to hack into your accounts on popular shopping sites such as Amazon and view your shopping history, or even order expensive goods to be sent to a pick-up address. (I did not ask Laurie or Sumner to attempt this because it would be in breach of data protection law.)

What can we do about all this? Well, not a lot, other than to be aware your information can be used in more sinister ways than you can possibly imagine, and to be on your guard.

As for your children, they can be warned to modify their behaviour and to think twice about what they write and post online and whom they accept as ‘friends’.

According to Linda Weatherhead, principal policy advocate for the campaign group Consumer Focus, social networking sites bear much responsibility for this explosion of potentially useful information.

‘It is a complex problem, but one simple way of making things safer would be to have all our information kept private as the default setting,’ she says. ‘Then it would be up to you how much you want to relax them as you decide to share more of your private
information.

‘Beyond that, we just have to be careful what we put out there — you can advise children about what they are doing, but you can’t wrap them in cotton wool. You can never make anything completely safe.’

But if Adam Laurie and Chris Sumner are right, then the risks of social networking extend far beyond a few embarrassing photos.

In particular, be careful who your ‘friends’ are; they could turn out to be your worst enemies.

original article here