Security Response

As is the case with every long weekend, the 4th of July weekend brought quite a lot of scams spreading through Facebook. Besides the usual click-jacking, hoaxes, and phishing attacks, one particular scam was discovered that showed the imminent evolution of this type of attack.

As always, the scam commences with a bait message – this time referencing a must-see video of some ex-girlfriend. Interestingly enough, most of the themes that we encounter have been used many times before, but unfortunately people still fall for them.

[Video] - This is what Happend to his Ex Girl Friend!
vidoea[REMOVED].blogspot.com
Play Video! She was Hurting for days, and could not walk!

Once the goo.gl link is clicked, the user is re-directed to a remote site. Google’s statistics page for that specific link showed that about 15,000 users have clicked on it. Of course, there were multiple links involved, so this figure only indicates an average estimate of...

Currently a new and unpatched cross-site scripting (XSS) vulnerability in Facebook is being widely used to automatically post messages to other user’s walls. The vulnerability was used for some time in some smaller cases; however, it is now widely being used for the first time by many different groups—especially in Indonesia, where we are seeing thousands of infected messages being posted by unknowing users.

The vulnerability exists in the mobile API version of Facebook due to insufficient JavaScript filtering. It allows any website to include, for example, a maliciously prepared iframe element that contains JavaScript or use the http-equiv attribute’s “refresh” value to redirect the browser to the prepared URL containing the JavaScript. Any user who is logged into Facebook and visits a site that contains such an element will automatically post an arbitrary message to his or her wall. There is no other user interaction required, and there are...

In order to see what is happening in social networks, I sat down and analysed about half a million wall posts from people who have their profile public and visible to everyone over the last month. Obviously this represents only a portion of all the messages posted by all the different users, for example the private posts only visible to friends were, of course, not monitored. Still, it is a good representation.

My first finding was that 21% of all the messages that contained a link pointed to a Facebook application, either through a URL-shortening service or by a direct link. Of those, 73% were actually scams or malicious applications.

Applying this to all the posts assessed reveals that around 15.6% or 1 out of 6 messages with a link that points to a malicious application. Therefore the chances that you may stumble upon such a message are relatively high.

While most...

Last week we talked about fast-flux attacks that were created by a Facebook toolkit. That particular scam wave was able to be active for more than a week, referencing more than 250 different malicious Facebook applications. There are many of these toolkits being used to spam Facebook such as Tinie, Arber, fbexpert, and NeoApp.

Toolkits and scripts are exchanged in underground forums, freshly generated accounts are traded, and tips are posted on how to lead users into clicking ads or filling out commissioned surveys. Of course this is not new—automated Facebook “Like” scripts have been around for a while. However, we have observed that the toolkits used are getting more sophisticated and easier to use.

Take a currently popular viral Facebook application toolkit called NeoApp as an example. It is being sold for $50, but can be found for much less in specific places...