Are you a member of a Facebook Group?
These groups are a place to share, learn, and connect on a topic or cause you are passionate about.
But what if you're passionate about hacking, selling stolen credit card numbers, or identification documents?
Or what if you're into helping set people up with fake (shell) email accounts tied to business or government domains? That is a great phishing tool.
Criminals are using Facebook Groups for these things right now.
Research: cyber criminals using Facebook to connect
Cisco Talos researchers just detailed how criminals and hackers are using Facebook Groups and how these criminals openly sell what they've stolen or hacked.
And this has been going on for years.
Group names include things like "Spam Professional," "Spammer & Hacker Professional," "Buy Cvv On THIS SHOP PAYMENT BY BTC 💰💵," and "Facebook
Take a look at these two examples of what people are sharing in these groups:
[Image credit: Cisco Talos]
Security researchers have this to say about their findings:
"In all, Talos has compiled a list of 74 groups on Facebook whose members promised to carry out an array of questionable cyber dirty deeds, including the selling and trading of stolen bank/credit card information, the theft
Researchers reported this activity to Facebook and many of these groups were closed. But then something else happened.
Big data allows cyber criminals to find each other on Facebook
After these groups are shut down, social media works its magic again. Using big data, Facebook helps cyber criminals reconnect in a new, like-minded group.
And the implications can be serious for every organization and agency, including yours.
"Facebook social media has provided tools enabling individuals from all over the globe to congregate and share ideas. This is one of social media's defining features. However, the underlying computer algorithms that help us connect, suggesting new friends or networks, are not intelligent enough to distinguish benign activities from the unethical or outright illegal... as a consequence of this, a substantial number of cyber-scammers have continued to proliferate and profit from illegal activities. Operating with impunity, these attackers relentlessly probe cyber-defenses of enterprises everywhere. This is a high-stakes endeavor because an attacker with even the smallest foothold inside an organization can do considerable damage."
We've heard stories of the risks during SecureWorld conferences this year.
We've also learned that an increasing number of attorneys are offering services on the Dark Web, which appears to be an untapped client market.
But if there's any real justice in the Facebook Groups that bring cyber criminals together, it could be summed up in the post below.
Someone paid for stolen information, but got phished:
There continues to be no honor among thieves.
[RELATED: Facebook Allowed Access to Unencrypted Passwords; Facebook CEO Wants More Regulation]
