The Social Pit

Now, one would think that the wonks at these platform headquarters would be immune to attacks, if not thanks to the millions spent by companies each year on cybersecurity products, then by their own personal awareness. This—as news items every day remind us—is simply not so. In fact, perhaps due to their over-confidence, they are ripe targets for everyday phishing.

Twilio, a major advertising platform that develops, administers, and tracks programmable communications tools, like phone calls, SMS messages, etc., is a multi-billion dollar enterprise communications firm. Valued at somewhat less, Cloudflare offers content-distribution networks (networks of proxy servers and data centers) and DDoS (Denial of Service) mitigation services.

Both were phished in the same month. In both cases, the flaw in the wall was an unwitting employee who handed his credentials over to a phishing campaign that victimized over 130 organizations. And, despite the latest authentication protocols and safety nets, these same companies are hit again and again—little to say of the social media platforms where security has never been an advertised strong point.

In fact, one of the biggest problem with social media is the ease with which an account can be taken over. One report states that account hijacking has increased by over 1,000% in the past year. The biggest threat here is to the social media advertising sector, which relies on the size of an advertiser’s following. This market is based on social media personalities with a following large enough to constitute an attractive advertising channel, and it’s worth about $16.4B per annum in the USA alone.

The followers of Instagram influencer are often counted in the millions, and the price for ransoming such an account—when hijacked by a scammer—can reach hundreds of thousands. A recent article in Dark Reading tells of the latest phishing campaign that hooks users by sending a phishing email threatening social account closure due to copyright infringement. Without thinking twice victims will click on the “Appeal” button—anything to avoid downtime. Often, the fake sign-in page will ask for the user’s multi-factor-authentication (MFA) telephone number, as well. Who has time to check if the URL is kosher? And before you know it, your account is no longer yours.

The Atlantic tells of one scammer who seized the account of an publicist managing a host of influencer accounts by sending him to a phishing page that spoofed a campaign tracking site. Once the publicist entered his client’s Instagram account details, the scammer began spamming the influencer’s followers with fake offers for free products. The hacker’s next step is either to directly sell spam to the followers or else to sell the influencer’s actual account to another budding marketeer.