Slashdot Log In
Facebook Widget Installs Zango Spyware
Posted by
CmdrTaco
on Sat Jan 05, 2008 01:16 PM
from the hate-when-that-happens dept.
from the hate-when-that-happens dept.
BaCa writes "A malicious Facebook Widget actively spreading on the social networking site ultimately prompts users to install the infamous "Zango" adware/spyware. The tremendous success and lightning fast expansion of Facebook empowered the social networking giant with an impressive user base. Needless to say, in a digital world where web traffic equals money, such a user base attracts spammers, virus/spyware seeders, and other ethic-less online marketers like honey would attract flies."
Related Stories
Firehose:Facebook Widget Installs Zango Spyware by Anonymous Coward
This discussion has been archived.
No new comments can be posted.
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
Full
Abbreviated
Hidden
Loading... please wait.
"like honey would attract flies" (Score:5, Funny)
Re: (Score:3, Funny)
Without exception... (Score:5, Insightful)
'caring' - imageogram
Obligatory (Score:5, Funny)
http://xkcd.com/357/ [xkcd.com]
Wouldn't install for me (Score:4, Informative)
Re: (Score:3, Funny)
It's times like this I'm glad I have a Mac, as I can continue to stalk people that barely know me without risk of getting a virus. =P
Too late (Score:4, Informative)
Re:Too late (Score:5, Interesting)
Whoever injected that spyware application will no doubt create a new developer account, and upload some variant of "Secret Crush". Blocking a particular application or a particular developer account is a short-term solution. I can only guess that more and more people are going to exploit Facebook apps for adware, spyware, phishing, identity theft, etc. Facebook will then be playing yet another game of "Internet whack-a-mole" where they try to block applications based on signatures, block developers based on IP address, and so on (with usual countermeasures of automated code variation, proxies, etc.). As we've seen from spam, viruses, spyware, and phishing, such games reach a stalemate where a certain fraction of users are becoming victims at any given time (typically the less savvy users, I suppose).
Personally I think Facebook should do a better job making the risks of third-party applications clear. The little "confirm that you want this application" question has already become so routine for most users that it means nothing to them. Moreover, the tight integration of third-party apps into the Facebook environment, though visually pleasing, leads most users to believe that the applications are written by and endorsed by Facebook. In fact, the code runs on third-party servers and those third-parties have access to profile data once you accept the app. Most Facebook users are surprised when you tell them this. And it's not always easy to tell who actually wrote a given application.
I think we all saw this coming, and I'm surprised Facebook didn't put in more safeguards to curtail the use of the app framework for spamming, phishing, and social engineering.
Parent
The widget is "Secret Crush" (saving you a click) (Score:5, Informative)
The widget in question (according to TFA) is "Secret Crush". The app asks you to complete several steps, including signing up 5 of your friends and installing a tray applet (containing the "infamous "Zango" adware/spyware") from Zango's site.
Re:The widget is "Secret Crush" (saving you a clic (Score:4, Informative)
Facebook is going to hell in a handbasket. They should never have opened to "anyone with an email address"; that's just asking for trouble. At least they're making money, right?
Parent
Am I the only person left? (Score:5, Funny)
From reading the press it seems to be some sort of web site where you upload all your private stuff for other people to see. I've never seen it though.
Don't feel bad, I don't get it either. (Score:4, Insightful)
I only went and checked it out a few weeks ago, after not being able to stand all the hype any longer.
I can't figure out what it's for. I've said as much here on Slasdot before, and was told that basically it's a mechanism to find/keep in touch with friends.
It's kind of like "classmates.com", except it's free.
I went and tried it out. First of all, they want you to use your real name. Like you noted, your "private stuff". Myself, I am seeking to
Once you have an account, there is very little to actually
I don't have any long lost friends to look up, and the couple of names I did plug in didn't get any hits. All of the people currently in my life that I want to keep up with I currently keep up with by other means, like email, telephone, or face-to-face.
I still don't understand the appeal of these "myspace" and "facebook" social web sites. What they really look like to me is an html-based web page creation utility, that allows people to create a personal web page without having to pay a hosting fee.
Since most ISPs these days give you a 5MB or so space where you can make a little web page if you want, I don't know why people don't just use that, except I guess they don't know how to make web pages. So MySpace, Facebook, etc., are like mini web-page software wizards to help you make a web page. Since all the web pages are centralized on one "server", they are thus also easily searchable / linkable.
If I wanted a web page to post things about myself, I'd go register a domain and some web hosting services and make one. I guess Facebook and MySpace are for people who don't want to go to the trouble.
Parent
Re:Don't feel bad, I don't get it either. (Score:4, Insightful)
Hmmm... well, if you used a fake name, then maybe all your former friends did too. The site only works if people use their real names. Facebook is exactly that for most people - kind of like classmates.com and Friends Reunited. It enables the maintenance of casual friendships without having to write/phone explicitly.
If you think about it, this is how most casual friendships work - I don't specifially talk to John down the hall at work to catch up, I might bump into him in the coffee room, see he's got a new shirt, find out it was his birthday yesterday etc. etc.. Just seeing and bumping into someone lets you stay in touch without it being an effort. Social networking sites let you do this. Email works for people you really want to stay in touch with, and chat forums work for a bunch of people who want to discuss the same topic(s). On Facebook I can find out that Fred who I went to school with is into a particular band too, and if there's a couple of other guys from school 10 years ago maybe a group of us could go to a gig. Nothing serious, nothing important, but if you like to stay loosely in touch with a whole bunch of people then it works really well.
Parent
Explicit maintenance of friendship... (Score:3)
>The site only works if people use their real names.
I really don't have any former friends. There is one guy I've lost track of over the years, but he never kept a phone (his girlfriends kept calling getting him in trouble with his live-in girlfriend) and he hated computers so I doubt he's on the web anyway. But other than him, I don't have any long-lost buddies I'm trying to keep track of. I never had friends in hig
Re:Explicit maintenance of friendship... (Score:4, Insightful)
Let me give you an example of a "casual friend". You know that guy at the bar who tells you about his band, and it sounds cool, but you don't want to get his phone number or give out yours just so you can check out their next show. The solution here is he can just tell you what his bands myspace is, or facebook, or whatever, and you can get the info there. No need for feigned friendships when you find out his band sucks.
Parent
I agree! (Score:3, Insightful)
>center of interest is one of the most worthless activity i've ever heard of.
My sentiments exactly. It also smacks of voyeurism to me. Maybe that is part of the appeal?
Re: (Score:3, Informative)
Facebook's core feature is the 'news feed', which basically shows what your friends have been doing on facebook, or what they've set their status to be, a little like twitter. Here's a snippet from mine:
Guy A started playing a game: Mass Effect
Girl A misses Guy A.
Girl B left the group The American Sandwich Society.
Guy B and Guy C are now friends.
Girl C is no longer listed as single.
It also al
Re: (Score:3, Funny)
Tag issues (Score:4, Insightful)
Personal responsibility -- don't install untrusted (Score:4, Insightful)
Facebook has nothing to do with the existence of this vulnerability. In fact, the browser-based app model explicitly is nice because of the sandbox effect, where such apps are very limited in what they can touch on your local machine. But when you convince people to break out of that sandbox by installing a local app, you can certainly kiss your computer goodbye.
--
Our microcontroller kit. Your gcc compiler. Learn digital electronics. [nerdkits.com]
Re:Ethic-less? (Score:5, Funny)
Parent
Re:Ethic-less? (Score:4, Funny)
Parent
Re:What is "Facebook"? (Score:5, Insightful)
Parent
Re:why are all facebook widgets so retarded? (Score:4, Insightful)
The reason it's like a second grade class room is because majority of users are of that mentality now. Just look at most of the "groups" now. Maybe they existed and I didn't notice before but all my groups were rather sane, now they're "IF U JOIN THIS GRUP WORLD PEACE WILL START!"
I've been on facebook since the beginning. And every minor improvement seemed to rock. They added photos. I was able to share photos in one place with most of my friends. I could invite friends over to a party with out having to e-mail every one. Yes, sometimes in college you don't get the opportunity to SEE all your friends every day.
And then the flood gates opened. The Developer thread was flooded with "HEAY I LOVE FACEBOOK CAN U MKE IT SO MUSIC PLAYS LIKE MYSPACE." People would kindly remind them that the whole thread was FOR developers. People could make 3rd party apps and it seemed pretty good because all the 3rd party apps were external. Then came the day that they let those 3rd party apps on everyones website. Then it just went to hell.
Thankfully Grease Monkey and scripts like:
http://userscripts.org/scripts/show/11992 [userscripts.org]
This exist.
Which is why I maintain 2 accounts. My 'professional' account. Uses my work address. All my college friends and people I know well. You can't find it anywhere. You can't search for it by name. Even if you know me I have to add you. Then my "Hi I just met you at the bar and I'm going to add you" account. Basic info. Searchable. Etc.
Parent
Re: (Score:3, Insightful)
Yes it does. It's called life, and we as a society should stop putting so much futile effort into working against it.