Facebook's hacked accounts for sale

During several weeks in February, iDefense tracked an effort to sell log-in data for 1.5 million Facebook accounts on several online criminal marketplaces, including one called Carder.su.

That hacker, who used the screen name “kirllos” and appears to deal only in Facebook accounts, offered to sell bundles of 1,000 accounts with 10 or fewer friends for $25 and with more than 10 friends for $45, says Rick Howard, iDefense’s director of cyber intelligence. The case points to a significant expansion in the illicit market for social networking accounts from Eastern Europe to the United States, he said.

Facebook’s response

Facebook says it believes that the hacker’s claims to control large numbers of Facebook accounts are bogus. The company attempted to purchase accounts as part of its investigation into the incident, said a spokesman, Barry Schnitt. However, “the hacker was unable to produce anything for our buyer,” he said. Facebook’s investigators also discovered that “kirllos” has a reputation “for wild claims,” he said.

“We would expect iDefense or anyone presenting themselves as a security expert to do this kind of verification (or any verification) rather than just reading a forum post and accepting the claims as fact and publicizing them,” Schnitt said in an e-mail message. IDefense could not be immediately reached for comment on the legitimacy of the hacker’s offer. However, it previously said that it did not purchase any of the accounts as part of its study because that would violate its corporate policy.

Criminals steal log-in data for Facebook accounts, typically with “phishing” techniques that tricks users into disclosing their passwords or with malware that logs keystrokes. They then use the accounts to send spam, distribute malicious programs and run identity and other fraud.

Why Facebook is vulnerable

Facebook accounts are attractive because of the higher level of trust on the site than exists in the broader Internet. People are required to use their real names and tend to connect primarily with people they know.

As a result, they are more likely to believe a fraudulent message or click on a dubious link on a friend’s wall or an e-mail message. Moreover, the accounts allow criminals to mine profiles of victims and their friends for personal information like birth dates, addresses, phone numbers, mothers’ maiden names, pets’ names and other tidbits that can be used in identity theft.

Last summer, Eileen Sheldon’s Facebook account was hacked and used to send messages to about 20 friends claiming she was stranded in Britain without a passport and needed money. Sheldon, who lives in California, had recently been living in London, and one friend, believing the ruse, wired about $100 to the thieves. Other friends smelled a fraud and warned Sheldon, who quickly reported the problem to Facebook. She does not know how her password was stolen.

While the accounts that were compromised and offered for sale could be legitimate ones like Sheldon’s, they most likely also included bogus accounts, Howard said. IDefense did not see the accounts themselves, but the inclusion of many accounts with small numbers of friends suggests the seller could have created fake accounts, perhaps using an automated tool, and sent out blind friend requests.

Many users are eager to amass friends and accept friend requests from people they do not know, even though Facebook discourages it.

Facebook equipped well

Facebook says it has sophisticated systems to defeat fake accounts, including tools for flagging them when they are created so they can be investigated. This allows Facebook to “disable them before the bad guys get very far,” a spokesman, Simon Axten, said.
Facebook also monitors for unusual activity that is associated with fake accounts, like many friend requests in a short period of time and high rates of friend requests that are ignored. It also investigates reports of suspicious users . The relatively low asking prices for the Facebook accounts points to the fact that Facebook accounts do not translate into instant profit. “The people that buy these things are going to have to do more work to make money,” Axten said.