Researchers have created a proof-of-concept application for Facebook that turns the machines of people who add the app to their Facebook page into elements of a botnet. In a demonstration, the botnet launched denial-of-service attacks on a victim server.
"Social-network websites have the ideal properties to become attack platforms," according to the Antisocial Networks: Turning a Social Network into a Botnet paper, written by five researchers from the Institute of Computer Science in Greece and one researcher from the Institute for Infocomm Research in Singapore.
The demo application, 'Photo of the Day', displays a new photo from
Such a botnet could be used for other types of attacks, such as spreading malware, scanning computers for open ports, and overriding authentication mechanisms that are based on cookies, the paper warns.
The researchers suggested that Facebook and other social networks exercise caution in designing their platform and application programming interfaces (APIs) so that there are few interactions between the "social utilities they operate and the rest of the internet".
"More precisely, social-network providers should be careful with the use of client-side technologies, like JavaScript, etc," the paper states. "A social-network operator should provide developers with a strict API, which is capable of giving access to resources only related to the system. Also, every application should run in an isolated environment, imposing constraints, to prevent the application from interacting with other internet hosts, which are not participants of the social network. Finally, operators of social networks should invest resources in verifying the applications they host."
In addition, the apps pose privacy risks because of the access they have to the data of the people who add them to their pages, the paper states.
Similar privacy and security concerns have been raised by other parties after third-party Facebook apps were found to have security holes.
Facebook representatives did not return emails seeking comment.
Talkback
Are these ALL users machines, or are they users windows machines? I think it should be clarified if all platforms can be compromised, or only those poorly designed.