Sophos Australia Facebook ID Probe 2009

Sophos, the world leading security and data protection firm, has just released the results of its 2009 Facebook ID Probe.  Sophos created two fictitious Australian users with names based on anagrams of the words "false identity" and "stolen identity". 21-year-old Daisy was represented by a picture of a toy duck from a $2 shop; 56-year-old Dinette had a picture of two cats. Each sent out 100 friend requests.

Within two weeks, a total of 87 strangers had agreed to be friends with Daisy and Dinette. This is exactly the same disturbingly high response rate as when Sophos first performed this experiment in England two years ago. Worse still, in the 2009 probe, Daisy and Dinette ended up with a total of 95 friends -- eight Facebookers befriended Dinette without even being asked.

"We assumed things would be better in 2009 but the situation is worse. This really is a wake-up call," said Paul Ducklin, Head of Technology, Asia Pacific at Sophos in Sydney. "Our honeymoon period with social networking sites ought to be over by now -- but many users still have a 'couldn't care less' attitude to their personal data."

98% of the 20-somethings and 92% of the 50-somethings who befriended Daisy and Dinette also gave away their birthday. A minority suppressed their year of birth, but this is often easy to calculate or to guess from other information given out. Even worse, just under half of the 20-ish crowd, and just under a third of the 50-ish crowd, gave away details about their friends and family.

"People aren't just handing over their own life story to cybercrooks," warned Ducklin. "They're betraying people close to them, too, by helping those cybercrooks build up a detailed picture of their life and their milieu. This is an identity scammer's dream."

Sophos is calling on users of social networking sites to think much more strictly about what it means to accept someone as your friend. "We're not trying to be wowsers," explains Ducklin. "We just want you to be much more circumspect about whom you choose to trust on-line."

Full details of the 2009 ID Probe (with 'pictures' of Daisy and Dinette) can be found at: http://www.sophos.com/blogs/duck/g/2009/12/06/facebook-id-probe-2009/