Want to read Slashdot from your mobile device? Point it at m.slashdot.org and keep reading!

 


Forgot your password?
Close
typodupeerror
×
Security Social Networks The Internet

Facebook Widget Installs Zango Spyware 137

Posted by CmdrTaco from the hate-when-that-happens dept.
BaCa writes "A malicious Facebook Widget actively spreading on the social networking site ultimately prompts users to install the infamous "Zango" adware/spyware. The tremendous success and lightning fast expansion of Facebook empowered the social networking giant with an impressive user base. Needless to say, in a digital world where web traffic equals money, such a user base attracts spammers, virus/spyware seeders, and other ethic-less online marketers like honey would attract flies."
This discussion has been archived. No new comments can be posted.

Facebook Widget Installs Zango Spyware More

Facebook Widget Installs Zango Spyware

Comments Filter:
  • The evolution of facebook took place to fast for the security to catch up.
    • Evolution is the right term - it certainly could not have been 'Intelligent Design!'

      jeffk

  • "like honey would attract flies" (Score:5, Funny)

    by John Hasler ( 414242 ) on Saturday January 05, 2008 @12:22PM (#21924170) Homepage
    There is something else that attracts flies which it more closely resembles...

  • Without exception... (Score:5, Insightful)

    by Anonymous Coward on Saturday January 05, 2008 @12:26PM (#21924198)
    All the apps are terrible. Asides from their 'myspacesqueness', they also release your entire profile & friends to an unknown entity. Facebooks TOS is bad enough, but atleast you have a sense of who your dropping all thoughts of ownership or privacy too.

    'caring' - imageogram

    • All the apps are terrible.
      Graffiti is fun, you get to draw things.
      Pretty things, if you're good.

      • Re: (Score:2, Funny)

        by jo42 ( 227475 )

        Graffiti is fun, you get to draw things.
        Pretty things, if you're good.
        Let me fix that for you:

        Microsoft Paint is fun, you get to draw things.
        Pretty things, if you're good.

        • Graffiti is fun, you get to draw things.
          Pretty things, if you're good.
          Let me fix that for you:

          Microsoft Paint is fun, you get to draw things.
          Pretty things, if you're good.
          It's not paint, it's a simple round brush, but it has transparencies.
          AND YOU GET TO SHOW OFF, because the whole point is that it's a social thing. Which, I shouldn't be surprised, is not readily understood by the /. crowd.

  • Obligatory (Score:5, Funny)

    by Weaselmancer ( 533834 ) on Saturday January 05, 2008 @12:30PM (#21924234)

    ...such a user base attracts spammers, virus/spyware seeders, and other ethic-less online marketers like honey would attract flies.

    http://xkcd.com/357/ [xkcd.com]

  • Wouldn't install for me (Score:4, Informative)

    by bconway ( 63464 ) on Saturday January 05, 2008 @12:31PM (#21924238) Homepage
    I tried to run it from the Facebook link in my sandbox, it wouldn't take. Looks like admin privileges are a requirement. I guess it's not surprising people aren't following the basic security steps that (even) Microsoft recommends.

    • Re: (Score:3, Funny)

      by slyn ( 1111419 )
      That's one of the major problems with Window's. The default security settings of a Microsoft product aren't even what Microsoft recommends.

      It's times like this I'm glad I have a Mac, as I can continue to stalk people that barely know me without risk of getting a virus. =P
    • Windows supposedly has the greatest security model in the world, but I don't understand it, I've never understood it, and I've never met anyone who could explain it to me. Occasionally there's ordinary files that aren't open but that I can't modify AND I HAVE NO CLUE WHY THIS HAPPENS. Some hidden attribute, God knows what it is. Etcetera.

      Vista proves what I've always suspected: even Microsoft can't set up a secure, usable Windows system without pissing me off on a continual basis with warnings and prompt

      • Re: (Score:2)

        by ettlz ( 639203 )

        Windows supposedly has the greatest security model in the world
        No it doesn't, it has ACLs.

    • Re: (Score:2)

      by pembo13 ( 770295 )
      That is how they have been trained for years. Part of the TCO i guess.
    • Typical SNS user: What's a sandbox? ... ooh! Free 3D emoticons! wee!

  • why are all facebook widgets so retarded? (Score:1, Insightful)

    by Anonymous Coward
    Facebook widgets are the new "I know someone who likes you" note-passing. Apps like "superpoke", "vampire bite", and now "secret crush"?

    Social networking sites are like second grade classrooms.

    • Re:why are all facebook widgets so retarded? (Score:4, Insightful)

      by 0100010001010011 ( 652467 ) on Saturday January 05, 2008 @01:53PM (#21925062)
      They let the highschoolers and world in.

      The reason it's like a second grade class room is because majority of users are of that mentality now. Just look at most of the "groups" now. Maybe they existed and I didn't notice before but all my groups were rather sane, now they're "IF U JOIN THIS GRUP WORLD PEACE WILL START!"

      I've been on facebook since the beginning. And every minor improvement seemed to rock. They added photos. I was able to share photos in one place with most of my friends. I could invite friends over to a party with out having to e-mail every one. Yes, sometimes in college you don't get the opportunity to SEE all your friends every day.

      And then the flood gates opened. The Developer thread was flooded with "HEAY I LOVE FACEBOOK CAN U MKE IT SO MUSIC PLAYS LIKE MYSPACE." People would kindly remind them that the whole thread was FOR developers. People could make 3rd party apps and it seemed pretty good because all the 3rd party apps were external. Then came the day that they let those 3rd party apps on everyones website. Then it just went to hell.

      Thankfully Grease Monkey and scripts like:
      http://userscripts.org/scripts/show/11992 [userscripts.org]
      This exist.

      Which is why I maintain 2 accounts. My 'professional' account. Uses my work address. All my college friends and people I know well. You can't find it anywhere. You can't search for it by name. Even if you know me I have to add you. Then my "Hi I just met you at the bar and I'm going to add you" account. Basic info. Searchable. Etc.

  • Too late (Score:4, Informative)

    by doofusclam ( 528746 ) <slash@seanyseansean.com> on Saturday January 05, 2008 @12:41PM (#21924334) Homepage
    Facebook have already blocked it, days ago...
    • that should keep it from spreading further, but the people already infected still have a problem.
      • You're correct, but the writeup uses current tense, thus giving the impression this is still spreading when it isn't.

    • Re:Too late (Score:5, Interesting)

      by kebes ( 861706 ) on Saturday January 05, 2008 @02:26PM (#21925396) Journal
      It's good the Facebook is blocking that app, but this points to a deeper problem with Facebook's implementation of third-party applications. This is just the beginning of Facebook being exploited by scammers.

      Whoever injected that spyware application will no doubt create a new developer account, and upload some variant of "Secret Crush". Blocking a particular application or a particular developer account is a short-term solution. I can only guess that more and more people are going to exploit Facebook apps for adware, spyware, phishing, identity theft, etc. Facebook will then be playing yet another game of "Internet whack-a-mole" where they try to block applications based on signatures, block developers based on IP address, and so on (with usual countermeasures of automated code variation, proxies, etc.). As we've seen from spam, viruses, spyware, and phishing, such games reach a stalemate where a certain fraction of users are becoming victims at any given time (typically the less savvy users, I suppose).

      Personally I think Facebook should do a better job making the risks of third-party applications clear. The little "confirm that you want this application" question has already become so routine for most users that it means nothing to them. Moreover, the tight integration of third-party apps into the Facebook environment, though visually pleasing, leads most users to believe that the applications are written by and endorsed by Facebook. In fact, the code runs on third-party servers and those third-parties have access to profile data once you accept the app. Most Facebook users are surprised when you tell them this. And it's not always easy to tell who actually wrote a given application.

      I think we all saw this coming, and I'm surprised Facebook didn't put in more safeguards to curtail the use of the app framework for spamming, phishing, and social engineering.
      • Interesting. I was actually blabbing on a different forum the other day on the fame of being the first to exploit apple users on a widescale, and pondering the use of facebook to social engineer the spreading. It seemed easier than attacking MacOS, just exploit the users instead of the software.

      • Re: (Score:1, Insightful)

        by Anonymous Coward
        I remember when Firefox faced similar criticism for its extension architecture. Facebook should attempt to create a secure repository for its applications. The Firefox problem is similar because its extensions, like Facebook applications, have the potential to convince someone to download a malicious script, and can collect and transmit data. Let people install any application, but create a reasonably safe place to get, rate, and upload the applications. Ultimately, it's a personal responsibility to ensure

  • The widget is "Secret Crush" (saving you a click) (Score:5, Informative)

    by stickyc ( 38756 ) on Saturday January 05, 2008 @12:48PM (#21924414) Homepage
    Quick summary:

    The widget in question (according to TFA) is "Secret Crush". The app asks you to complete several steps, including signing up 5 of your friends and installing a tray applet (containing the "infamous "Zango" adware/spyware") from Zango's site.

  • In the same way that MS created IE so that third parties could gain control of your computer to generate profits(think of pop ups that were not disabled until XP SP 2, a continuing lack of Flash blocking, even though images can be blocked) I wonder if facebook has somehow facilitated this spyware. Clearly, if facebook gets a cut of revenue generated by the spyware, this would result in some large coin.

  • Am I the only person left? (Score:5, Funny)

    by Joce640k ( 829181 ) on Saturday January 05, 2008 @12:56PM (#21924504) Homepage
    Am I the only person left who doesn't know what facebook is?

    From reading the press it seems to be some sort of web site where you upload all your private stuff for other people to see. I've never seen it though.

    • Re: (Score:2)

      by Nimey ( 114278 )
      Are you this guy?

      http://www.theonion.com/content/node/28694 [theonion.com]

    • Don't feel bad, I don't get it either. (Score:4, Insightful)

      by maillemaker ( 924053 ) on Saturday January 05, 2008 @01:28PM (#21924794)
      If you aren't the last person, you're not by much.

      I only went and checked it out a few weeks ago, after not being able to stand all the hype any longer.

      I can't figure out what it's for. I've said as much here on Slasdot before, and was told that basically it's a mechanism to find/keep in touch with friends.

      It's kind of like "classmates.com", except it's free.

      I went and tried it out. First of all, they want you to use your real name. Like you noted, your "private stuff". Myself, I am seeking to /limit/ my online exposure, not enhance it, so of course I created a fake account.

      Once you have an account, there is very little to actually /do/, that I can see. You are supposed to join "networks", but there weren't any that seemed interesting to me.

      I don't have any long lost friends to look up, and the couple of names I did plug in didn't get any hits. All of the people currently in my life that I want to keep up with I currently keep up with by other means, like email, telephone, or face-to-face.

      I still don't understand the appeal of these "myspace" and "facebook" social web sites. What they really look like to me is an html-based web page creation utility, that allows people to create a personal web page without having to pay a hosting fee.

      Since most ISPs these days give you a 5MB or so space where you can make a little web page if you want, I don't know why people don't just use that, except I guess they don't know how to make web pages. So MySpace, Facebook, etc., are like mini web-page software wizards to help you make a web page. Since all the web pages are centralized on one "server", they are thus also easily searchable / linkable.

      If I wanted a web page to post things about myself, I'd go register a domain and some web hosting services and make one. I guess Facebook and MySpace are for people who don't want to go to the trouble.

      • Re:Don't feel bad, I don't get it either. (Score:4, Insightful)

        by uglyduckling ( 103926 ) on Saturday January 05, 2008 @02:59PM (#21925720) Homepage
        I created a fake account... I don't have any long lost friends to look up, and the couple of names I did plug in didn't get any hits.

        Hmmm... well, if you used a fake name, then maybe all your former friends did too. The site only works if people use their real names. Facebook is exactly that for most people - kind of like classmates.com and Friends Reunited. It enables the maintenance of casual friendships without having to write/phone explicitly.

        If you think about it, this is how most casual friendships work - I don't specifially talk to John down the hall at work to catch up, I might bump into him in the coffee room, see he's got a new shirt, find out it was his birthday yesterday etc. etc.. Just seeing and bumping into someone lets you stay in touch without it being an effort. Social networking sites let you do this. Email works for people you really want to stay in touch with, and chat forums work for a bunch of people who want to discuss the same topic(s). On Facebook I can find out that Fred who I went to school with is into a particular band too, and if there's a couple of other guys from school 10 years ago maybe a group of us could go to a gig. Nothing serious, nothing important, but if you like to stay loosely in touch with a whole bunch of people then it works really well.
        • >Hmmm... well, if you used a fake name, then maybe all your former friends did too.
          >The site only works if people use their real names.

          I really don't have any former friends. There is one guy I've lost track of over the years, but he never kept a phone (his girlfriends kept calling getting him in trouble with his live-in girlfriend) and he hated computers so I doubt he's on the web anyway. But other than him, I don't have any long-lost buddies I'm trying to keep track of. I never had friends in hig

          • Re:Explicit maintenance of friendship... (Score:4, Insightful)

            by EveLibertine ( 847955 ) on Saturday January 05, 2008 @05:11PM (#21926922)

            If you are worthy enough of friendship than I will make the effort to maintain that friendship explicitly.
            Well, what the poster before you was trying to say was that social networking sites attempt to lower the amount of effort. You mention an effort, but the idea is that in the glorious future as we develop these tools there will be virtually no effort required. Of course, nothing out there now has fully succeeded, but they are trying. Also, nobody cares about the nonsensical trivia that people enter into their profiles on these sites. It does, however, give that lady at the front desk at your work something to do when there's nobody moving through the lobby.

            Let me give you an example of a "casual friend". You know that guy at the bar who tells you about his band, and it sounds cool, but you don't want to get his phone number or give out yours just so you can check out their next show. The solution here is he can just tell you what his bands myspace is, or facebook, or whatever, and you can get the info there. No need for feigned friendships when you find out his band sucks.
          • Ultimately I figure I'm just anti-social and consequently the thrill of accumulating lots of "casual friends" just holds very little appeal to me. I'm also one of those people who never asks strangers, "How are you doing?" because I don't really care how some stranger is doing, and I know it's just a dumb little thing that people say to each other as a greeting and most people don't care how you are doing, either.
            Sometimes if you just pretend that you like people long enough, you actually will, then you fin
          • It's not antisocial, cos I feel the same way about these websites. They're just a way to hunt for gossip on your "friends." There's a reason they all display "relationship status" and crap like that, as well as "current favorite band" and other information that, if it was actually important, it would come up in conversation with your real friends.

            Thankfully, for those who prefer to know a lot of people without actually having to spend time with those people getting to know them, social networking sites
        • If you use your real name wouldn't she know who to sue for child support later on?

      • Re: (Score:3, Informative)

        by tapo ( 855172 )
        Actually, the purpose of Facebook is to not only find friends, but to allow you to communicate with them more easily.

        Facebook's core feature is the 'news feed', which basically shows what your friends have been doing on facebook, or what they've set their status to be, a little like twitter. Here's a snippet from mine:

        Guy A started playing a game: Mass Effect
        Girl A misses Guy A.
        Girl B left the group The American Sandwich Society.
        Guy B and Guy C are now friends.
        Girl C is no longer listed as single.

        It also al

      • Re: (Score:2)

        by bazorg ( 911295 )

        I went and tried it out.[...] Once you have an account, there is very little to actually /do/, that I can see.

        the way I see it there is all sort of game-like application you can use with your friends. most are about "make believe" that you did something with them. It's good light-hearted fun. now if you'll excuse me I'm just getting my baseball and will be off your lawn in a second.
      • I suppose the answer in the words of my generation would be "generation gap". Which seems to be occurring multiple times within a genration nowdays.
        • You know, youth may actually have a lot to do with it.

          After reading the trivial things you get to keep track of from the post just above yours (I.E., guy B leaves the American Sandwich Society), I gather that this sort of things gives you very trivial data about people - things you just don't really need to know or keep track of.

          When I was younger I had time for such dalliances. But as an adult with a 50+ hour work week, a wife and a child, a house, cars, and the rare time out for hobbies and gaming, I jus

      • Re: (Score:3, Insightful)

        by aj50 ( 789101 )
        Originally Facebook was designed to appeal to university students (I believe you had to have a uni e-mail address to sign up) and for this target market, it works very well. When you start university, you quickly meet lots of new people who you might not bump into again and whose names you're trying to remember.

        One of it's most useful feature is that you can search through people at your uni who've signed up, you can search for people who are doing the same course as you, you can get enough background infor

      • I can't figure out what it's for.

        It's for organizing parties.

        Since most ISPs these days give you a 5MB or so space where you can make a little web page if you want, I don't know why people don't just use that, except I guess they don't know how to make web pages.

        Because the point is the social network.

        Anecdote: So this girl I know in meatspace asks me if I'm coming to her party, I don't know what party she meant, we discuss the fact that I'm not in her facebook friends, the following day we digitize our friendship, and I finally see the event page (limited to her friends) with all the relevant details and a handy "coming/not/maybe" RSVP system.
        You get to see who's going to the party, who isn't, and the whole thing is done with a nice c

        • OH MY GOD! I was just masturbating and thinking about you, and then BONGO there's one of your posts. How the fuck are you doing old buddy?
        • >Anecdote: So this girl I know in meatspace asks me if I'm coming to her party, I don't know what party she meant...

          This is where I would pull out a pencil and get the details of when and where the party was. I suppose it is marginally easier to say, "Oh, go check out my facebook page for the details" so you don't have to write anything down, but it doesn't seem to be /that/ huge of a thing to me

          • >Anecdote: So this girl I know in meatspace asks me if I'm coming to her party, I don't know what party she meant...

            This is where I would pull out a pencil and get the details of when and where the party was. I suppose it is marginally easier to say, "Oh, go check out my facebook page for the details" so you don't have to write anything down, but it doesn't seem to be /that/ huge of a thing to me

            Well we didn't have to stop the social event to find pen, paper, and to write things down, have her spell it out over the music, etc.
            It seriously was a huge improvement over the regular party planning procedure.

    • Well, you and me both. I never got the appeal of those 'social networking' sites.

      (clicks http://images.slashdot.org/neutral.gif [slashdot.org])
    • Don't worry, there are at least two of us left.

      I don't do facebook, youtube or any RSS. I am too paranoid and just don't trust 'pushy' media.

    • Re: (Score:3, Funny)

      by Albert Sandberg ( 315235 )
      Slow down cowboy! I'm slowly grasping how this blog thing works!

  • Tag issues (Score:4, Insightful)

    by lpangelrob ( 714473 ) on Saturday January 05, 2008 @01:15PM (#21924660)
    While the tag "shitattractsflies" is somewhat amusing when describing (as an aside, Facebook started exclusively on college campuses some 5 years ago, now), I think the more insightful tag would be "peopleattractshit".

    • Facebook started exclusively on college campuses some 5 years ago, now
      I miss those days.
    • Right. The missing noun is "Facebook", as in, "when describing Facebook".

      And yes, I used preview. I think programming in PHP just greatly diminished my grammar this morning.

  • Personal responsibility -- don't install untrusted (Score:4, Insightful)

    by compumike ( 454538 ) on Saturday January 05, 2008 @01:21PM (#21924718) Homepage
    Don't voluntarily install untrusted executable files! Period! There is no vulnerability without the user thinking that they want what's inside.

    Facebook has nothing to do with the existence of this vulnerability. In fact, the browser-based app model explicitly is nice because of the sandbox effect, where such apps are very limited in what they can touch on your local machine. But when you convince people to break out of that sandbox by installing a local app, you can certainly kiss your computer goodbye.

    --
    Our microcontroller kit. Your gcc compiler. Learn digital electronics. [nerdkits.com]
  • Well, at least Scoble is safe.

  • Needless to say, in a digital world where web traffic equals money, such a user base attracts spammers, virus/spyware seeders, and other ethic-less online marketers like honey would attract flies.

    It's a good thing that these "spammers, virus/spyware seeders, and other ethic-less online marketers" would ever take advantage of of the /. user base!

    Oh wait... [slashdot.org]

    Yaz.

  • firefox extension + script for facebook users (Score:1, Informative)

    by Anonymous Coward
    People with Firefox can install the "stylish" extension (for controlling CSS), and, along with the "De-MySpacify" script, block all appearances of facebook apps in their browser. ( http://userstyles.org/styles/3681 [userstyles.org] ). It's about 15 lines long and incredibly helpful (not to mention aptly-named).
  • The Profile Hug [facebook.com] application embeds an iframe in its request notification that sometimes (but not always) redirects the user to an external site that then shows facebook in an iframe along with advertisements. Facebook has yet to do anything about this app (though I have notified them).

    For those who don't know how Facebook works, basically when one person installs an app, the app will pester them to request their friends also install it. A friend of mine installed it, which sent me a request that appears o
    • Can you be a bit more specific? A Facebook app can choose to run FBML (display data passed back to Facebook and displayed) or an iframe, where you see Facebook navigation, but the rest of the page is iframe loaded from developer's server.

      What you are describing is a bit different, and I just want to make sure I understand it right.

    • Re: (Score:1)

      by keot ( 667523 )

      For those who don't know how Facebook works, basically when one person installs an app, the app will pester them to request their friends also install it.

      You need to speak with your friends.
      When you install a Facebook application there is a choice at the end of the process whether or not to spam all your friends with an invite to use the application. You can't avoid Facebook itself placing a 'Person installed application Foo' into your friend's news-feeds. However you can set preferences on your own news-feed to avoid such items appearing, using the 'x' button beside the item.

  • It's worse than an app.. it's actually an ad. It may be an actual app. However, it advertises itself as a banner and says you have 11 messages waiting. Click it, and it says they delete so many messages a day, and you are down to 3. I figured out pretty quickly when they asked for my gender (which they should have already if they were really a Facebook app) that it was fake.. besides the fact, it used images.. but there was no border around the banner, and no word "Advertisement". Facebook needs to correct
  • I'm afraid this is all rumour and innuendo according to Zango:

    http://blog.zango.com/PermaLink,guid,94c0e12c-c69e-484f-81b8-b8b58953d71b.aspx [zango.com]
    (summary: users are clearly told they are downloading something, so what's the problem?)

    And try to keep up with the times, /. Don't you know: "Zango Advisory: As of this posting, the Zango security team has observed that the Secret Crush widget on Facebook is now called the "My Admirer" widget."
  • why is this bias being injected into submissions? 'online marketers' aren't necessarily 'ethic-less,' even if their ethical standpoints don't necessarily coincide with their own. i would guess they do share ethical ideas with everybody using slashdot, though. they certainly utilize facebook to spread their ideals, which is what a lot of facebook users do on a regular basis (and what every living, thinking, non-hermit person who has any effect on the world does, consciously or unconsciously). this idea t
    • http://www.php.net/nl2br [php.net]. seriously, it's 2008. and what's up with the 2 minute+ wait between posting? i don't even see an option for editing my post (i haven't looked very hard, so if somebody wants to just chime in if that option exists i'll be really grateful for saving me the time i might have to spend finding it, what a pointless pursuit that would be]). for a site written by people capable of understanding how to...create a site, this one sure is a pain in the ass to use.
  • Why limit your social life by posting as an ac?

Slashdot Top Deals

You are always doing something marginal when the boss drops by your desk.

Close