Russian Hacker sells hacked facebook accounts

A spammer/scammer named Kirloss is selling 1.5 million Facebook accounts for a few pennies apiece. Yours might be one of them.

Want to hear some good news? We now know exactly how much your Facebook profile is worth on the open market: Between 25 and 45 cents, depending on whether you have more than 10 friends.

The bad news? How we found out.

According to Verisign's iDefense, a Russian hacker known as Kirllos is selling 1000 Facebook IDs at a pop for $25 (if you have 10 friends or less) or $45 (if you're in the 11+ friends crowd). Thus explaining that rash of bogus Facebook password reset spam I got last month. He's apparently successfully phished log ons for some 1.5 million Facebookers, which he's now hawking on the antichat.ru forums.

Is your account one of them? There's really no way to know for sure, unless you're seeing stuff posted under your name you didn't put there. But if you've recently responded to an email purporting to be from Facebook asking you to log into your account, there's a very strong chance the answer is yes. (I'd recommend logging in and changing your password to something tricky. Do it right now. Go on, I'll wait.)

What can some miscreant do with your Facebook identity?

* He can use it to infect other Facebook users by posting links on your friends' walls to Web sites containing malware, a la the Koobface worm, which has been tormenting users of Facebook, MySpace, and Twitter for two+ years. Koobface can suck your PC into a botnet, at which point it doesn't really belong to you any more.

* He can use it to run big-money con games on your friends, a la the infamous "London Scam" in which a cybercrook pretends to be an old friend of yours who's stranded overseas and needs you to wire him cash -- fast. The London Scam took at least one U.S. victim for $4,000. Unlike Nigerian 414 scams, which requires mind-numbing stupidity on the part of its victims, the London Scam directly attacks affluent, college-educated, computer literate people. (I had a friend who got approached by the same scammer, who was seriously considering wiring the money until I explained what was going on.)

* He can use it to embarrass, harass, or blackmail you. Want to ruin someone's reputation in a hurry? Log on as them and post humiliating or hateful content on their page.

But here's the bigger threat. Facebook really wants to be the single sign-on engine for the Web (see "What's to like about Facebook's 'Like' button?"). So a Facebook log on isn't just a Facebook log on anymore; it's also a log on to sites like Unvarnished, the Huffington Post, and any others that use Facebook Connect. If that's not an argument against using Facebook for single sign on, I don't know what is. Even if you don't use FB Connect, most people tend to use the same log ons for multiple sites; once a crook has your email address and favorite password, he can go to town on you. Nervous yet?

Bottom line: Your Facebook credentials are important, and only getting more so. If you want to protect yourself online, you'll need to protect them as well. Start by mixing up your passwords for your favorite sites, changing them semi regularly, and not getting duped by every stupid email marked "urgent."

Also: I gotta say I find this whole thing kind of insulting. I've got 700+ friends. I think my account is worth at least $1.50. Don't you?

Facebook Security Issues

Facebook has been the victim of five different security problems in the month of March, says Trend Micro.

According to the security firm, four hoax applications have become available on the social network along with a new variation of the Koobface virus, which was first detected at the end of last year, and directs users to a fake YouTube page where they are encouraged to install malware.

Two of the hoax applications that have been downloaded by Facebook users include 'F a c e b o o k - closing down!!!' and 'Error Check System'. By downloading the app, users are giving hackers access to their profile and personal information, and also unwittingly forwarding fake messages to their friends, also encouraging them to download the programs.

Rik Ferguson, senior security advisor at Trend Micro told the BBC:"It's been a pretty bad week for social networking in general".

"It's almost as if the applications we have seen this week are a proof of concept," he said. "It would be much better for them to generate rogue applications that did not look like rogue applications."

Ferguson also revealed that he believes hackers are currently working on creating apps that don't initially appear to be malicious. He predicts these apps will appear on social networking sites very soon.

"One of the problems is that Facebook allows anybody to write an application and third party applications are not vetted before they are released to the public. Even as Facebook stamps out one malignant application, it can pop up in another place," said Graham Cluley, senior technology consultant at Sophos

However, it appears Facebook is still refusing to vet apps before they are made available on the social network.

Founder Mark Zuckerberg told Radio One last month: "Our philosophy is that having an open system anyone can participate in is generally better".