While Facebook’s newly announced graph search capability is awesome for people who like social networking, it also provides criminals with another source of information about potential targets. The ability to query like this really opens a can of worms.

In spear phishing land, criminals are always searching for information to craft personalized and seemingly genuine emails.

This feature nets search results not just of your Facebook friends, but also the friends of your friends, which can potentially be a pretty large network.

It’s pretty easy to set up an anonymous Facebook account, establish a network of friends, and begin using this new search feature to discover information about lots of people.

We’ve seen law enforcement catch criminals by creating fake identities on Facebook to gather information, and we know that advertisers use information from social networking sites to target customers, criminals do the same.

From an enterprise standpoint, the best defense continues to be an educated user base. Security executives can’t prevent employees from posting information on Facebook, and they can’t prevent Facebook from sharing that information liberally. However, employees can be trained to be safe email users that can recognize a suspicious email and avoid interacting with it.


Author: Rohyt Belani, CEO at PhishMe.