Facebook to Shield Ads From Offensive Content

In a message posted on its Web site, the company wrote: “Our goal is to both preserve the freedoms of sharing on Facebook but also protect people and brands from certain types of content.”
“We know that marketers work hard to promote their brands, and we take their objectives seriously. While we already have rigorous review and removal policies for content against our terms, we recognize we need to do more to prevent situations where ads are displayed alongside controversial Pages and Groups. So we are taking action.”
Facebook said it would begin the manual review for pages containing sensitive content next week with a team of hundreds of employees in offices around the world.
The action comes a month after feminist groups campaigned for an improvement in Facebook’s process for identifying and removing pages that glorify violence against women. At the time, Facebook acknowledged that its procedures had not worked effectively. Activist groups sent more than 5,000 e-mails to Facebook’s advertisers and elicited more than 60,000 posts on Twitter, requesting the removal of pages featuring women who had been abused.
The protests caused Nissan and a number of smaller advertisers to temporarily withdraw their ads from the site. Other advertisers, including Zappos, Dove and American Express, stopped short of removing their ads but issued statements on digital media saying they did not support violence against women.
“The way you allocate your resources identifies what your priorities are,” said Soraya Chemaly, a writer and activist who was involved in the digital media campaign.
Ms. Chemaly said that since the protests in May Facebook had been “great” about removing content the groups flagged as offensive but that the procedure for removing such content had not been systematic. “Before you can remove the ads, you need to have an accurate assessment of what counts as controversial and that’s not happening now systemically,” she said.
Elisabeth Diana, a Facebook spokeswoman, said dealing with offensive content was something the company handled on a daily basis. “We take it really, really seriously,” she said, adding that the goal of the new procedure “won’t be as much content policing as there will be advertising policing.”
Removing the ads from such pages also removes a pressure point that activist groups have used to get media companies and advertisers to listen to their concerns. “They are hoping to dismantle the leverage,” Ms. Chemaly said. “From a business perspective that makes perfect logical sense.”
The company expects to automate the process of identifying such content after a manual review of thousands of its pages.
Follow me on Twitter @sajilpl

Citadel malware variant uses content localization to target brands and users in different countries

A new variant of the Citadel financial malware uses in-browser injection techniques combined with extensive content localization to steal log-in credentials and credit card information from users in different countries, according to researchers from security vendor Trusteer.

 

Citadel has the ability to modify or replace websites opened by users on infected computers. This is known as a man-in-the-browser attack and is frequently used by financial Trojan programs to trick users into exposing their log-in details and other sensitive information.

 

The new Citadel variant targets users of social networks, banks and major e-commerce sites, including Amazon and its local versions in France, Spain, Italy and Germany, the Trusteer researchers said in a blog post.

 

International as well as local brands are targeted, said Etay Maor, fraud prevention manager at Trusteer, Thursday via email.

 

When the targeted websites are accessed from computers infected with the new Citadel variant, the malware replaces them with rogue versions that claim users' accounts were blocked because of suspicious activity. The victims are then asked to input their personal and credit card information in order to confirm that they are the legitimate owners of the accounts and proceed to unlock them.

 

This particular social engineering technique has been used for years in phishing attacks. However, unlike in traditional phishing, when websites are modified locally by Citadel or similar malware, the URLs displayed in the browser's address bar are those of the legitimate websites.

 

The use of localized HTML injections by financial malware is not new, but the extra effort put into this new Citadel variant to make the rogue content believable makes it stand out, Maor said.

 

The particular variant uses some interesting technical tricks to create the injection screens, Maor said. For example, it includes customized drop down menus and requests for information generated in local languages, he said.

 

These implementation aspects, the operating team's behavior and the botnet's command-and-control structure point to a detail-oriented and professional operation, Maor said.

 

Based on data collected and analyzed by Trusteer, the company's researchers estimate that several thousands of computers have been infected with this new Citadel variant so far.

 

Earlier this month Microsoft said that it worked with the FBI and other technology industry partners to disrupt more than 1,400 botnets based on the Citadel malware. The company estimated at the time that those botnets were responsible for more than US$500,000 million in losses to people and businesses around the world.

 

Microsoft's effort disrupted the operation of many Citadel botnets, but anyone with a Citadel builder -- an application used to build customized versions of the Trojan program -- can create a new variant and start a new operation of his own, Maor said. "We actually see new Citadel botnets in play."

 

Follow me on Twitter @sajilpl

Cisco fixes serious vulnerabilities in email, Web and content security appliances

Cisco Systems released security patches for its email, Web and content security appliances in order to address vulnerabilities that could allow attackers to execute commands on the underlying OS or disrupt critical processes.

 

The vulnerabilities affect different versions of the Cisco IronPort AsyncOS operating system that's used in the Cisco Content Security Management Appliance, the Cisco Email Security Appliance and the Cisco Web Security Appliance.

 

Releases 7.1 and prior, 7.3, 7.5 and 7.6 of the software in the Cisco Email Security Appliance are affected by three vulnerabilities, one that allows remote attackers to inject and execute commands with elevated privileges through the Web interface and two that could be used to crash the management graphical user interface (GUI) or the IronPort Spam Quarantine service and cause other critical processes to become unresponsive.

 

Exploiting the command injection vulnerability requires authentication via the Web interface with at least a low privilege account, but the denial-of-service vulnerabilities can be exploited remotely without authentication.

 

Users of the 7.1 branch should upgrade to version 7.1.5-016 or later, users of the 7.3 branch should upgrade to version 8.0.0-671 and users of the 7.5 and 7.6 branches should upgrade to 7.6.3-019 or later, Cisco said in a security advisory published Wednesday. Releases in the 8.0 branch are not affected.

 

Branches 7.2 and prior, 7.7, 7.8, 7.9 and 8.0 of the Cisco Content Security Management Appliance software are affected by the same command injection and denial-of-service vulnerabilities as the Cisco Email Security Appliance software.

 

All of the vulnerabilities are patched in versions 7.9.1-102 and 8.0.0-404, Cisco said in a separate advisory. Users of 7.2 and prior, 7.7 and 7.8 branches are advised to upgrade to version 7.9.1-102 or later of the software. The 8.1 versions are not affected.

 

Releases 7.1 and prior, 7.5 and 7.7 of the Cisco Web Security Appliance software are vulnerable to two authenticated command injection vulnerabilities and one management GUI denial-of-service vulnerability. Some of the vulnerabilities are the same as those affecting the Cisco Email Security Appliance software.

 

The software releases that include fixes for all three Cisco Email Security Appliance vulnerabilities are 7.5.1-201 and 7.7.0-602. Users of the 7.1 and prior versions are advised to upgrade to 7.5.1-201 or later.

 

Follow me on Twitter @sajilpl