Clickjacking Worm Exploits Facebook "Like" Feature 124
An anonymous reader writes "For the last 24 hours, a series of attacks have exploited Facebook's 'Like' feature through a clickjacking vulnerability. Using subjects such as 'This Girl Has An Interesting Way Of Eating A Banana, Check It Out!' hackers have spread an attack that links to web pages that use invisible iFrames to trick users into saying they like the content. Users are presented with a innocent-seeming web page that says 'Click here to continue,' but clicking at any point on the page publishes the same message to their own Facebook page. Security blogger Graham Cluley says that hundreds of thousands of Facebook users have been hit, and offers advice on how to clean up affected Facebook profiles.
Link? (Score:5, Funny)
I hate posts without proper links...
So, who will post the direct link to the girl with an interesting way of eating a banana?
Re:Link? (Score:4, Informative)
http://www.mprosperstats.info/bananalike/index.htm?ref=search&sid=dpf-GrMT3GTEEuQTlotyMg.3788977952..1
Re: (Score:2)
So is there a safe link to the bananna-eating girl pic? Just asking as a public service since it seems a lot of people want to see it.
Re: (Score:2, Informative)
Probably NSFW depending how up tight your boss is:
http://www.youtube.com/watch?v=It7cHFyms0Q [youtube.com]
Re: (Score:2)
Re: (Score:1)
404
Re: (Score:3, Interesting)
I know because I tried clicking on it
Reminds me of this bash.org quote. [bash.org]
Re: (Score:3, Informative)
Reminds me of this bash.org quote.
That's a great quote, so I kind of feel like a bastard for spoiling it, but... P2P programs generally recognise identical files by their hash value; so if the guy simply renamed some files that were already out there under their original name, they'd have used his copy for certain parts, even if people didn't search under it for that name.
Re: (Score:1)
So...
Couldn't one just find out the hash values of the pieces of the files they are downloading and generate random data until the hash value matches?
Slow, yes.
Generating a movie randomly? Priceless..
Re:Link? (Score:4, Funny)
Re: (Score:2)
No the banana is real I assure you; the girl is the lie.
Re: (Score:1, Funny)
I will. Here it is. [glumbert.com]
That video's got to be at least 3 years old, and I'm still impressed.
Re: (Score:1)
I was afraid to click the link... (Score:3, Funny)
Re: (Score:3, Informative)
Flea of Pain like this.
caterpillar (Score:4, Insightful)
Why does the Slashdot section on worms have a picture of a crawling caterpillar?
Re:caterpillar (Score:5, Funny)
Why does the Slashdot section on worms have a picture of a crawling caterpillar?
They do it just to bug people ;-)
Re: (Score:2, Informative)
If it helps, those are often called inchworms.
Re: (Score:2)
In the US perhaps; I've never heard the term here in the UK - not that I talk about caterpillars very often of course...
Re: (Score:2)
According to wikipedia, they are the caterpillar form of the geometer moth [wikipedia.org], which are commonly called loopers, spanworms, or inchworms. There are apparently 300 varieties in the UK and over 1200 in North America, so it seems to be pretty common both places.
Re: (Score:2)
The big hungry inchworm wouldn't have sold nearly so well.
Re: (Score:2)
In the US perhaps; I've never heard the term here in the UK.
You got metric, it's the common 2,54cm worm.
Re: (Score:2)
Pff. Give worms an inch and they’ll take a mile.
Re: (Score:2)
Because it's cute and fuzzy, obviously. Also, I like pretty butterflies. ./~ <3
NoScript (Score:4, Informative)
Thank you NoScript for stopping this for me. I knew it looked "phishy."
Re:NoScript (Score:5, Informative)
Better yet, use NoScript's ABE facility to block any non-Facebook web page from loading a Facebook page or API. From http://noscript.net/abe/ [noscript.net] :
# This one allows Facebook scripts and objects to be included only .facebook.com .fbcdn.net .facebook .fbcdn.net
# from Facebook pages
Site
Accept from
Deny INCLUSION(SCRIPT, OBJ, SUBDOC)
Re:NoScript (Score:4, Interesting)
Here's the line from my unbound.conf that solves all Facebook related problems for me:
local-zone: "facebook.com." static
followed by no local-data lines.
I see "address not found" error messages on lots of web pages: Facebook iframes are freaking everywhere. No more.
Re: (Score:2)
Re: (Score:1)
Re: (Score:2)
Re: (Score:3, Informative)
A similar technique for Privoxy users can be found here: http://bmearns.net/wwk/view/Privoxy [bmearns.net]
By default it only stops cookies. At the bottom of the page it is explained how to block all Facebook access from third party sites.
Re: (Score:2)
Thanks, I’ll be blocking those domains in AdBlock now...
facebook.com$third-party,domain=~fbcdn.net
fbcdn.net$third-party,domain=~facebook.com
That should ensure that content from both domains will work together on the Facebook site itself... I’ll have to wait until I get home to actually test them, though.
(I knew facebook.com obviously but I also knew there was a 2nd domain that I didn’t remember off the top of my head.)
Oh, and here’s a freebie (it got used on this page, in fact):
#a(hr
Re: (Score:2)
Strike that, seems that these are the required filters. The ones I posted earlier don’t seem to do anything.
||facebook.com^$third-party,domain=~fbcdn.net
||fbcdn.net^$third-party,domain=~facebook.com
Re: (Score:1)
Re: (Score:3, Interesting)
Reason #1 why I refuse to switch to Chrome.
Re: (Score:2)
About that...
Re: (Score:2)
Not in a way that isn't a complete pain in the ass for frequent surfing. Plus, it doesn't support deep control or even come close to preventing click-jacking on pages you allow.
Re: (Score:2)
Deep control is totally unnecessary and only highly slows down page rendering times.
Interesting that you seem to know exactly what my needs are. The primary reason I use NoScript is to block JavaScript beyond page-level. The Chrome feature you're referencing is far too heavy-handed for my needs.
So going back to the original statement, I'll gladly continue to use Firefox for surfing while I'll keep using Chrome as part of my development toolset.
Advice (Score:3, Insightful)
Graham Cluley ... offers advice on how to clean up affected Facebook profiles
Here. I'll offer the simplest advice you can get: Stop clicking on stupid shit.
Just by doing that, internet/computer security would be vastly improved. Once all of our moms and computer-illiterate uncles learn that one little gem, we'll be a long ways towards solving most of the computer-related security issues. Of course there are steps after that to really nail down security but, until people stop clicking on stupid shit, we're fighting a losing battle.
Re: (Score:3, Funny)
I can't wait till a link from the Idle section turns out to be serving up malware...
Re: (Score:2)
Re: (Score:2)
In case you haven't noticed, the editors are fond of sneaking Idle articles into the other sections... samzenpus, especially.
Re: (Score:2)
That would be redundant as Idle is, itself, malware.
Re: (Score:2)
Re: (Score:3, Insightful)
The thing about click jacking is you don't have to click on stupid shit. You could be clicking on something entirely legitimate, or so you think.
Re: (Score:1)
P.S: Do we have to remind people that this shit work only on M$ platform?
Re:Advice (Score:4, Interesting)
"P.S: Do we have to remind people that this shit work only on M$ platform?"
iFrame malware isn't *JUST* a Windows issue. Think harder next time.
Re:Advice (Score:5, Insightful)
Here. I'll offer the simplest advice you can get: Stop clicking on stupid shit.
Just by doing that, internet/computer security would be vastly improved.
Eh. The scammers use "stupid shit" as the bait because that's what works. If "intelligent shit" started attracted the most clicks, they'd start using that instead.
Once a single mouse click on an infected link is enough to propagate the link, it's already game over--the choice of bait is a detail.
Re:Advice (Score:5, Insightful)
Eh. The scammers use "stupid shit" as the bait because that's what works. If "intelligent shit" started attracted the most clicks, they'd start using that instead.
You mean "This New Intel CPU Has A Great New Hologram! Check It Out!" won't work?
Re:Advice (Score:5, Funny)
Eh. The scammers use "stupid shit" as the bait because that's what works. If "intelligent shit" started attracted the most clicks, they'd start using that instead.
OK I'm all confused now. Just answer the question, is "Why Apple Is So Sticky" safe to click on or not?
Re: (Score:2)
It's Juicy.
Re: (Score:2)
Not while you’re at work.
Re: (Score:2)
Eh. The scammers use "stupid shit" as the bait because that's what works. If "intelligent shit" started attracted the most clicks, they'd start using that instead.
It is, however, much, much harder to create intelligent shit than stupid shit. Which is not to say it's particularly hard to create mildly intelligent shit, it's just so damn easy to create stupid shit these days. Five seconds of randomly reading Facebook will show you what I mean.
s/Facebook/\/./
FTFY
Re: (Score:2)
Re: (Score:1)
Here. I'll offer the simplest advice you can get: Stop clicking on stupid shit.
Eh. From what I see, most people are on FB precisely because of it - people seem to like clicking on stupid shit.
Re: (Score:1)
Stop clicking on stupid shit.
Absolutely. Don't click here [facebook.com]
Re:Advice (Score:5, Insightful)
Sometimes, stupid things are funny. I don't live in a bubble, and if my friends think something stupid is funny or interesting, I want to see it, because I care about what my friends think and because I find value in sharing an experience and because it might actually be worth my time.
I don't have to use Facebook, but it's how a lot of my friends choose to communicate, and my social life is healthier because of it. Many of them aren't geographically close enough to see them in person often, and those that are don't always have a compatible schedule, so Facebook allows me to stay in contact with people I wouldn't otherwise be able to (indeed, I've reconnected with people on Facebook that I haven't seen in over a decade, who are on the other side of the globe).
I think it's reasonable to expect that when I click a link to a web page, nothing bad should happen to me. In fact, nothing did happen - I'm not sure if that's because Facebook has already blocked this, or my browser has built-in security measures in place to prevent it, or (more likely) the exploit failed due to some bug or incompatibility. I looked at the HTML, saw what it was trying to do, saw that it was malicious, and went no further. That's how I WANT things to work.
Re: (Score:2)
> I think it's reasonable to expect that when I click a link to a web page,
> nothing bad should happen to me.
Why not shorten that to "I think it's reasonable to expect that nothing bad should happen to me"?
Re: (Score:2)
Can't you use e-mails, IMs, IRC, etc. instead? I was on Facebook, but was kicked off for using fake datas. I did NOT want Facebook to have my real datas.
Re: (Score:2)
Can't you use e-mails, IMs, IRC, etc. instead?
No, because many of my friends won't use them.
Re: (Score:2)
That sucks. Not even IMs and e-mails -- two common Internet things. Wow. :(
Re: (Score:2)
That sucks. Not even IMs and e-mails -- two common Internet things. Wow. :(
Some do use IM, which is fine if they happen to be online at precisely the same moment I am. And they generally can all receive e-mail, but they wouldn't send me e-mail for anything that wasn't really important; for just generally staying in touch it's not the medium of choice.
I know, it seems crazy, because e-mail is such a huge part of our lives, but the unenlightened see things differently.
Re: (Score:2)
I think it's reasonable to expect that when I click a link to a web page, nothing bad should happen to me.
It partially depends on what your idea of “bad” is. A line gets posted to your news feed saying that you “like” something. That could be mildly embarrassing but it’s not bad to the same degree as getting your computer rooted or stepping off the curb and getting hit by a truck.
Didn't work for me (Score:2)
I encountered this on Facebook a few minutes before seeing it on Slashdot. I'm not sure why, but it didn't work for me. Does Safari have any sort of built-in protections against this sort of thing? Or has Facebook blocked it already? Or did it just not work due to a bug somewhere?
Re: (Score:2)
Does Safari have any sort of built-in protections against this sort of thing?
It's not MS IE?
Re: (Score:2)
I saw it too, and same thing. Safari wouldn't do anything with the click. But I'm running Safari Ad Block, Flash Block, and a couple other plug ins that may have stopped it.
Re: (Score:2)
It definitely works in Safari, though it's possible that Facebook has blocked the problem links. That said, check your "my profile" page as it doesn't show up the homepage feed.
Interesting, but... (Score:1, Funny)
This has been going on for weeks, I received three at least two weeks ago. It wasnt that hard to realize it was malicious; my sister doesnt tend to care about how other women eat bananas
Re: (Score:2, Interesting)
I figured it was probably malicious, but it was from a friend who's usually on the up-and-up, so I jacked up my security temporarily, and clicked. When I got the big white page with "click to continue," yeah, that's confirmation. Not a single one of those is in any way legit. Ever.
Re: (Score:2)
Re: (Score:2)
The only reason it doesn't happen more often is that stupidity-exploiting malice seems to be supply limited at this time.
Fix is right here (Score:4, Informative)
and offers advice on how to clean up affected Facebook profiles.
No problemo, just click right here:
http://www.facebook.com/group.php?gid=16929680703 [facebook.com]
The title is "How to permanently delete your facebook account." Or, is it?
Related (Score:2)
If you think that'll work, you might want a look at this...
http://www.theonion.com/articles/entire-facebook-staff-laughs-as-man-tightens-priva,17508/ [theonion.com]
New? (Score:1)
I got hit by this a few weeks ago, there was a similar 'Bet You Don't See...' item to Like. I had the impression it was going to be like the basketball/gorilla video, but it automatically invited all my friends, etc..there was no way (i could see) to not do it once you were sucked in.
I 'reported' it (although the Facebook 'report' button is entirely inadequate for this), and encouraged the friend i got this from to as well..
Why is this only coming up now? When i hit that page, it had already sucked in nearl
Re: (Score:2)
If something requires you to “like” it before you’ve even seen it, you should already not like it even one bit...
P.S.
This applies to real life in general, not just stupid Facebook pages.
Re: (Score:1)
I didn't... It got me to paste a URL into my browser (which of course i was suspect of, but d'uh..but it was rather sneaky about it, and i was tired at the time), and then it did its thing.
I didn't actually ever click 'like', which is part of the problem...and that this is only getting attention now.
Culture20 likes you. (Score:2)
Yep, saw it last night. (Score:3, Informative)
Out of curiosity, I opened the link in a separate browser without my Facebook login. It would then try to do a "security check" in which you have to answer a survey to prove that you're human. Being the smart Slashdotters we are, we know Captchas are how it's done. The main take-away: (1) Hover, look, and think before you click and (2) If the link goes outside Facebook, it is SPAM and should be reported.
I think I just got targeted from an ad. (Score:1)
While opening a bunch of feed items (including this one) which included several different websites, I was prompted to download "like.php" which is a kind of thing that happens when websites set bad headers...
None of my tabs failed to load, so I'm guessing this came from a rogue advert (?)
I don't have a facebook account though, so I'm not worried.
Could have been worse... (Score:2)
Related exploit (Score:1)
This is why I have a separate FF profile for FB (Score:2)
To solve problems like this. No matter what Mark Z decides to Zuckerpunch my privacy settings into tomorrow or the next time he secretly changes them, or not matter what bullshit he opts me into, the rest of my webbrowsing (slashdot and wikipedia) will remain separate from FB's braindead "features".
I already removed almost all my personal info of course, but facebook is simply too big to close completely. It would close off a useful service. Again, it's not that I object to FB trying to make a profit to sup
No more bees? (Score:1, Offtopic)
The most common suggestion I've gotten - gasoline....:(
I usually.... (Score:2)
If you hover first over the web page, you can see what is clickable and what is not, if the whole webpage looks like one big url link to be clicked, then flag goes up in MY head...so don't click, but i think with javascript there are ways to even eliminate the hover click icon for x, y position and make it avalable only between the points....i may be wrong though, my javascript is a bit rusty....i think it was a x , y point element you had to set....anyhow...still gives you a heads up if there was no real c
Re: (Score:2)
Yes, it’s the cursor CSS style and you don’t really need Javascript unless you want to change it dynamically (i.e. change it to a hand inside a box region while making it a default pointer everywhere else).
However your rule of “if the whole webpage looks like one big url link to be clicked, then flag goes up in MY head” is rather inadequate because they could just as easily make the sticky iframe only follow your mouse when it’s inside the box region that would normally corresp
Re:StoneLion (Score:4, Interesting)
If you click on his name, it shows he's one of those social media guys. "Slight" would be an understatement, and understandably - it's his job.
Plus, Facebook is in the news for its' privacy screw-ups. They have less than 3 months left in their deal with the Canadian government to bring their site into compliance with Canadian law (which is what got the whole "Facebook has a privacy problem" thing going 9 months ago, and got other governments to then launch similar probes).
Re: (Score:2)
It's not that simple. Several European countries have followed our lead, and if Facebook doesn't comply, they face sanctions - and as we've seen in the news lately, that includes having their plug pulled in various countries, which certainly will affect both their revenue and their valuation.
What's Facebook worth if Canada, Europe, and chunks of South America all pull the plug? Way less than half, because the "network effect" cuts both ways.
It opens the doors for competitors that have better privacy p
Re:8===D O: == Muhammad (Score:5, Informative)
Re:8===D O: == Muhammad (Score:4, Insightful)
There's something everyone can do to fix it for themselves, though: log off when you're done using Facebook. Of course, that makes it harder to tell your little friends about how you "heart" (sorry, Like) various things.
Re: (Score:3, Insightful)
Much simpler to abandon security-plagued Facebook, the Windows 98 of social networking sites (myspace would be the Windows 95 equivalent).
Re: (Score:2)
and replace it with ... ?
Re: (Score:2)
I want to know what domain to AdBlock on 3rd-party websites to block this sort of thing for good. Basically I want to disable all of Facebook’s javascripts that 3rd-party sites are trying to embed. If somebody knows off the top of their head, it’d be very helpful... but if not I guess I’ll have to figure it out myself. I’m not going to install NoScript, so don’t bother telling me to do that.
Fuck Facebook and its attempted invasion into every other part of my life. I like Facebo
Re: (Score:2)
He used lowercase HTML! Burn the heretic!
Just kidding.