Security Response

It has come to our attention recently that a website is giving out instructions on how to use a low tech social engineering trick to view private Facebook profiles. To view the instructions, a third-party application must be first downloaded and installed. While this application is not malware, it may impact computer performance. The instructions then describe how to view private Facebook profiles, with the result being that a Facebook user may receive a friend request from a person that is already on their friend list.

The social engineering trick lies in the fact that the friend request is not from the “friend” that it purports to be from. The friend request may also come with a personal message; the instructions also suggest a message, “Hey, I can’t login to the previous account. add [sic] me back in.” Since the friend request received both via email and Facebook looks legitimate (because it is legitimate; that is, the...