Toolbar with Trojan sauce

Recently I’ve been giving presentations at the Canberra Security Interchange Group meetings about hacking, Web 2.0 and other security things.  The last one was an introduction on rootkits. I’m pleased to say that the interest was high so I’ll be doing a ‘rootkits in depth’ presentation in April.

Anyway, Derek Knight posted this to a mailing list that I read. https://www.avertlabs.com/research/blog/index.php/2009/02/10/trojan-bundles-legit-social-network-toolbar-with-backdoor/

It’s all about a Trojan that masquerades as a toolbar for a German social networking sight.

I think the part that struck me a bit ironically is that I was having a chat earlier tonight on Facebook with someone. I had even said that I don't like Facebook applications because they are basically tools for spammers and phishers to pharm email addresses and personal information about people.

Here’s an example of someone taking advantage of the proliferation of Web 2.0 personal data sprawl. 

I think we’re becoming way too cavalier with our personal data, and how blindly we allow things to access our personal data on these kinds of sights. Facebook itself isn’t too bad if you use it correctly.  But if you put all of your personal information on there, and leave it open to the public, anyone can read it and I promise, not everyone that sends you a friend request out of the blue has good intentions.

Now even if you don’t make the information publically available, if you add an application to Facebook, and accept it’s little agreements, it can still access all your data and harvest it or do whatever it wants to with it. So be careful about how you use these social networking sights. A little healthy internet paranoia is a good thing these days.