Facebook's redirect error foretells the future of hacking
Last week Facebook suffered an "error" that had an astounding ripple effect, as users of thousands of popular websites were inadvertently redirected to a Facebook error page. It was shocking to learn that Facebook Connect could disrupt every site it linked to -- but even more troubling was the glimpse it gave us of future hacker attacks.
In security circles, the underlying issue is termed "transitive trust." The average popular website links to all sorts of sites and services, with the typical home page featuring more than a dozen third-party links. Each of those links can be used by hackers for malicious intent. Your website or service is only as secure as its weakest link -- literally.
Transitive-trust hacking is nothing new. It occurs every time a banner ad running on an innocent website ends up linking to a malicious Web creation. It happens every time a hacker finds out how to hack a common website management control or widget. My favorite example was when a popular cartoon syndicate was hacked, and all the online newspapers linking to everyone's favorite cartoons got malware pushed to them. In all the cases, the "innocent" websites were compromised because they assumed the integrity of another site.
