Posted tagged ‘Fb’

Facebook clickjacking moves to comments

April 14, 2011

If you’re a security-conscious person who pays attention to the latest online threats, then you almost certainly know about the dangers of clickjacking. You probably also know some of the most common ways to avoid clickjacking attacks. For instance, when you log on to Facebook, you don’t follow inflammatory links that promise pop culture oddities such as Jessica Alba naked or Justin Beiber yelling at a young fan. Instead, you bypass those links because you know they are exactly the types of headlines that clickjackers use to attract victims.

Unfortunately, your careful activities might not make you as safe as you think.

That’s because clickjackers have evolved. Once they  recognized that many Internet users had gotten wise to their plots, they switched up the game to find new victims. One of the latest strategies involves placing clickjacks in photo comments.

Here’s an example scenario:

You  just uploaded pictures from your vacation when you see that a friend has commented on one of your photos. You look at it only to find a message reading something like “great pic, check out mine!” You feel safe because the comment has come from a trusted friend. When you follow the link, though, you unleash a clickjacking attack that could infect your computer.

How do you protect yourself from these new attacks? It’s not entirely clear yet. There are, however, a couple of things that you can do to reduce the likelihood  that you’ll become a victim. If you see a comment that seems out of character for your friend, then don’t follow any of his or her links. Contact that friend to find out whether she actually posted the link. Instead of using Facebook, you should use that person’s actual email address. That way, you  can avoid the possibility that someone else has gained access to your friend’s Fb account and will simply reply to your query.

Mundolike Clickjack – Me No Like

April 8, 2011

Beware of a new clickjacking attack spreading through Facebook. This one spreads like so many other clickjacks: through user wall posts. This particular attack is recognizable by the post “Usted debe ver esta película! x.mundolike.com” along with a lude picture meant to convince you to follow the link. When you follow the link, it directs you to a page on mundolike.com that contains a video. There’s nothing sexy about it, though. When you click play, you get a video of a prank that involves throwing mannequin heads at unsuspecting people. It’s not even funny.

What else do you get?

Our old friend the clickjack. The video’s play button covers a Facebook”like” button. When you press play, you spread the clickjack through your Facebook wall by unintentionally posting the link.

This clickjack could trick you even if you sign out of Facebook before visiting the mundolike page. If you have signed out, then the page will redirect you to the standard Facebook log in page. When you sign in, it automatically posts the clickjack to your wall.

So much for trying to outsmart this clickjack.

It doesn’t seem that anything truly malicious happens when you fall for this scam. It just makes a fool out of you by using your wall to spread to other people. Some clickjack attacks, however, steal passwords and other private information. You can’t be too careful. If you have fallen victim to this clickjack attack, then remove it from your wall and change your password to make sure your account is safe.

 

 

Potential Stroke Victim Gets Clickjacked on Facebook

February 16, 2011

Serene Branson, an on-air personality for CBS 2 in LA, might have had a stroke on live TV during last weekend’s Grammy Awards. Millions of viewers have since watched the video of her breakdown, which included slurred speech and utter gibberish.

What happened next could only be possible in the modern world: her video went viral on Internet sites such as YouTube and Facebook.

After the video went viral and received millions of hits, some hacker recognized it as an opportunity to make some money. The hacker used the video to spread a clickjacking attack throughout Facebook.

The attack works just like numerous other clicjkacks that have been spread through Facebook. It starts off innocently enough: curious Facebook members see a post about the video, so they follow the link. It’s basic human curiosity that urges us to watch someone having a meltdown of sorts on television. It seems so unbelievable that many of us cannot resist.

Once the Facebook member clicks the link, though, things start to get fishy. First, they are asked to take a short quiz before viewing the video. That should send up a big flag that something is amiss. Surveys of this sort are frequently used by hackers. They submit the results to survey businesses for payment. It’s basically the driving force behind this and similar clickjacking attacks.

After completing the online survey, Facebook users are told that they need to allow an app to view the video. That’s another flag that should convince users to take pause. And with good reason, the button that allows the app has been clickjacked to spread the link to other Facebook members by posting it on the person’s wall. That’s how these scams spread so quickly.

Clickjacking Problems Worsen

January 26, 2011

You can always count on Sophos to give you the bad news. They’ve come through with solid research before, and it looks like they’ve just released another report showing that the Internet is in a bad way, at least when it comes to security.

According to surveys conducted by Sophos, 40 percent of people using social networking sites like Facebook and Twitter have been exposed to some sort of malware. 40 percent probably sounds pretty high to you. It’ll sound even more outrageous when you realize that the number of people is actually 90 percent higher than the number of people affected by malware in 2009.

Why the huge jump?

A lot of it has to do with the increased popularity of social networking sites. A couple years ago, Twitter was just starting to become popular. You’d hear some real geeky friends talking about it, but your parents sure weren’t getting tweets at all hours.

Hackers have also upped their game to take advantage of flaws in the Internet and, dare I say it, human nature. Clickjacking, for instance, barely even existed a few years ago. Those who knew about it were mostly the same people trying to protect Internet users from it. Today, hackers have figured out how to create some rather ingenious clickjack attacks that can turn on your camera, purchase items without your explicit permission, and even install malware to your computer.

And human nature… that’s a problem not easily solved. Hackers have used everything from celebrity gossip to sex tapes to convince people to visit their websites. Once you click on that site, you’ve been jacked.

My Total Facebook Profile Views

January 25, 2011

Social networks are about popularity and connections, so it’s no wonder that people on Facebook are curious to know how many people have viewed their profiles. Facebook, however, has consistently prevented users from seeing how many people (and, more specifically, which people) have looked at their profiles.

While preventing users from accessing this information keeps online activity a bit more private, it also creates a vacuum that cybercriminals are eager to fill.

One of the latest clickjacking attacks that cybercriminals use focuses on giving Facebook members access to information that they have never been able to see before. Unfortunately, the hackers don’t really have applications that can provide accurate information.

The My Total Facebook Views scam promises to tell Fb members how many people have looked at their profile pages. By doing so, it preys upon human curiosity and the desire to see where one fits into the social hierarchy.

When you follow a link to the app (typically named either Pro Check or ProfileSpy), you’re prompted to take an online survey. After taking the survey, you’re given a number that supposedly represents how many people have accessed your profile. In reality, it’s just a random number without any basis in reality.

In addition to tricking you into taking online surveys for nothing in return, the app uses a clickjacking attack to spread itself to your friends. The clickjack posts information on your wall that encourages friends to take the survey and find out how many people have looked at their profiles.

That’s how it perpetuates itself and makes plenty of money for cybercriminals. As long as you stay informed, though, you don’t have to fall victim to this clickjacking scam.

Cheryl Crow gets clickjacked

December 13, 2010

Fans of Cherly Crow, the British pop star and judge of The X-Factor, should watch out for a Facebook post that promises to, um, expose the young singe: the post contains a clickjacked link that will “like” the post and share it with friends.

As far as convincing clickjacks go, this one’s pretty bad. The hackers have taken a picture of Crow getting out of a  car and superimposed a big censored sign, suggesting that she was pulling a “Britney,” as it were, and posted it on a fake BBC web page. Yes, BBC, as in British Broadcasting Corporation, which doesn’t tend to focus a whole lot of celebrity genitalia.

The fake page isn’t very convincing, but it doesn’t need  to be. The damage is done as soon as  you follow the link. Anyone who has clicked on this post can look at their recent activities, where they will find that they liked the post without ever having clicked a like button. This has happened because the hackers used a clickjacking technique to hide an invisible frame that contains a Facebook like button. Even though you never knew that you clicked it, Facebook doesn’t  see the difference.

Hackers have found that this is a convenient way to spread links quickly. The very nature of social networking sites like Facebook means that clickjacked links can spread to thousands of people within a few short hours.

You can protect yourself by only following links that you trust. If you are uncertain of a source’s legitimacy, then do a little research before following the link.