Researchers at VeriSign's iDefense division tracking the digital underworld say bogus and stolen Facebook accounts are on sale in high volume on the black market.
During several weeks in February, iDefense tracked an effort to sell log-in data for 1.5 million Facebook accounts on several online criminal marketplaces, including one called Carder.su. That hacker, who used the screen name ''kirllos'' and appeared to deal only in Facebook accounts, offered to sell bundles of 1,000 accounts with 10 or fewer friends for $25 and with more than 10 friends for $45, said Rick Howard, iDefense's director of cyberintelligence.
The case points to a significant expansion in the illicit market for social networking accounts from Eastern Europe to the United States, he said. Criminals steal log-in data for Facebook accounts, typically with ''phishing'' techniques that trick users into disclosing their passwords or with malware that logs keystrokes. They then use the accounts to send spam, distribute malicious programs and run identity fraud and other scams. Facebook says it believes that the hacker's claims to control large numbers of Facebook accounts are bogus.
The company attempted to purchase accounts as part of its investigation into the incident, said a spokesman, Barry Schnitt. However, ''the hacker was unable to produce anything for our buyer,'' he said. Facebook's investigators also discovered that ''kirllos'' has a reputation ''for wild claims,'' he said. ''We would expect iDefense or anyone presenting themselves as a security expert to do this kind of verification (or any verification) rather than just reading a forum post and accepting the claims as fact and publicizing them,'' Mr. Schnitt said in an e-mail message.
Facebook says it has sophisticated systems to defeat fake accounts, including tools for flagging them when they are created so they can be investigated. This allows Facebook to ''disable them before the bad guys get very far,'' said a spokesman, Simon Axten. The relatively low asking prices for the accounts point to the fact that they do not produce instant profit. ''The people that buy these things are going to have to do more work to make money,'' Axten said.
