A new report sheds light on Facebook‘s continued struggles to police cybercrime on its platform.
Security researchers from Cisco’s Talos Intelligence Group discovered 74 Facebook groups buying, selling or trading stolen credit card information, identity information like drivers licenses and forms of photo identification, as well as email phishing kits, forging services and other illegal or illicit activities.
All told, the groups had about 385,000 members, the researchers said.
Scroll down for video
An example of a post from one of the Facebook groups peddling stolen credit card information and other forms of photo identification. The 74 groups were found by Cisco’s security division
WHAT KINDS OF DATA ARE BEING SOLD ON FACEBOOK?
- Stolen credit card numbers
- Personal identification information like photo IDs
- Account credentials
- Email phishing kits
- Spamming tools and services
- Forging services
- Assistance in moving large sums of money
Researchers said they didn’t have to look very hard to find the Facebook groups, which they referred to as an ‘online criminal flea market,’ since they operated ‘right out in the open’ on the site.
Many of the groups used fairly obvious names, including ‘Spam Professional,’ ‘Spammer & Hacker Professional’ and ‘Facebook hack (Phishing).’
Users can also search the terms ‘spam,’ ‘carding’ or ‘CVV’ and it will generate multiple return results.
Many of the posts promised access to stolen data, saying things like ‘Selling CVV fresh $5’ or ‘100k mail list fresh.’
In one case, researchers discovered a group where a user promised access to a spam kit that delivered fake Apple invoices to Hotmail and Yahoo email users.
Once users click on the invoice, it sends them to a malicious website.
Pictured is a post in one of the groups discovered by Talos researchers that seeks access to shell accounts at education and government organizations
In another case, Talos researchers happened upon a user claiming to send fake Apple invoices to Hotmail and Yahoo inboxes. The links in the invoices send users to malicious websites
Talos researchers verified that the invoices matched up with phishing scams it had previously identified.
‘Despite the fairly obvious names, some of these groups have managed to remain on Facebook for up to eight years, and in the process acquire tens of thousands of group members,’ Talos researchers explained.
When the researchers began searching these kinds of groups, Facebook’s algorithms then promoted additional groups in the Suggested Groups section of its site.
Since Talos discovered the groups, all 74 of them have been taken down by Facebook.
‘However new groups continue to pop up,’ the researchers said, adding that they are still working with Facebook to further identity and remove groups of this nature.
‘These Groups violated our policies against spam and financial fraud and we removed them,’ a Facebook spokesperson told MailOnline, adding that most of them were created in 2018.
The report sheds light on Facebook’s continued struggles to police cybercrime on its platform. In addition to spam content, the firm has worked to remove disinformation and hateful content
Another post from one of the groups discovered by Talos researchers shows a user selling card verification values (CVVs) for credit cards. They said it was easy to find groups selling this data
‘We know we need to be more vigilant and we’re investing heavily to fight this type of activity.’
In addition to removing the groups, Facebook identified the accounts behind them and blocked their ability to create additional groups.
The firm uses a combination of machine learning and human moderators to police these kinds of content on its site.
Between July and September 2018, Facebook removed over 1.2 billion pieces of spam content, according to its latest Community Standards Enforcement Report.
Additionally, Facebook recently doubled its safety and security team to more than 30,000.
The Talos findings follow a separate report from Brian Krebs of Krebs on Security, in which Krebs found about 120 private groups that had amassed 300,000 members and were promoting spam services, wire fraud and the sale of stolen data.
HOW CAN YOU AVOID SPAM?
The Federal Trade Commission has highlighted some of the key ways users can avoid spam emails (file photo)
The Federal Trade Commission has recommended the following tips to decrease the amount of spam that clutters your inbox:
Filter your emails: Check to see if your email account provides a filtering tool that can weed out potential spam. The suspect messages can be directed to an email folder that will contain all supposed spam messages.
Do not publicly display your email addresses: Be wary of including your email contact info on blogging sites, social media sites, in chat rooms or in membership directories. The FTC warns that spammers harvest email addresses left on these sites.
Pay attention to privacy policies: When you hand over your email address on a website, check to see if that website is asking for permission to sell your email address. Uncheck boxes when agreeing to privacy policies so that companies have limited access to your personal info.
Pick an email address that is unique: Your email address could affect the volume of spam that lands in your inbox. The FTC explains: ‘A common name such as jdoe may get more spam than a more unique name like j23d0e34.’