Slashdot Mirror
Clickjacking Worm Exploits Facebook "Like" Feature
An anonymous reader writes "For the last 24 hours, a series of attacks have exploited Facebook's 'Like' feature through a clickjacking vulnerability. Using subjects such as 'This Girl Has An Interesting Way Of Eating A Banana, Check It Out!' hackers have spread an attack that links to web pages that use invisible iFrames to trick users into saying they like the content. Users are presented with a innocent-seeming web page that says 'Click here to continue,' but clicking at any point on the page publishes the same message to their own Facebook page. Security blogger Graham Cluley says that hundreds of thousands of Facebook users have been hit, and offers advice on how to clean up affected Facebook profiles.
I hate posts without proper links...
So, who will post the direct link to the girl with an interesting way of eating a banana?
Violence is the last refuge of the incompetent. Polar Scope Align for iOS
after that article.
Why does the Slashdot section on worms have a picture of a crawling caterpillar?
Thank you NoScript for stopping this for me. I knew it looked "phishy."
Graham Cluley ... offers advice on how to clean up affected Facebook profiles
Here. I'll offer the simplest advice you can get: Stop clicking on stupid shit.
Just by doing that, internet/computer security would be vastly improved. Once all of our moms and computer-illiterate uncles learn that one little gem, we'll be a long ways towards solving most of the computer-related security issues. Of course there are steps after that to really nail down security but, until people stop clicking on stupid shit, we're fighting a losing battle.
I encountered this on Facebook a few minutes before seeing it on Slashdot. I'm not sure why, but it didn't work for me. Does Safari have any sort of built-in protections against this sort of thing? Or has Facebook blocked it already? Or did it just not work due to a bug somewhere?
$x='S24;r)>63/* h@<5+oZ)32"5cz';$me='phroggy'x$];
$x=~y+ -xz+\0-Tx+;print$_^chop$me for split'',$x;
This has been going on for weeks, I received three at least two weeks ago. It wasnt that hard to realize it was malicious; my sister doesnt tend to care about how other women eat bananas
I'm shocked this doesn't happen more often, 95% of facebook's users are complete idiots.
If you click on his name, it shows he's one of those social media guys. "Slight" would be an understatement, and understandably - it's his job.
Plus, Facebook is in the news for its' privacy screw-ups. They have less than 3 months left in their deal with the Canadian government to bring their site into compliance with Canadian law (which is what got the whole "Facebook has a privacy problem" thing going 9 months ago, and got other governments to then launch similar probes).
and offers advice on how to clean up affected Facebook profiles.
No problemo, just click right here:
http://www.facebook.com/group.php?gid=16929680703
The title is "How to permanently delete your facebook account." Or, is it?
"Science flies us to the moon. Religion flies us into buildings." - Victor Stenger
The real problem isn't as much of an exploit so much as it is Facebook's platform for cross-site publishing is basically broken. They allow any site to act as the user with no confirmation other than a click, which as we've seen is easy to get via an invisible iFrame that follows the mouse. Aside from revamping the way they handle "Likes" and other such things on other sites, there's not much they can do to "fix" it.
Use lynx.
Don't use Facebook, tadah.
I got hit by this a few weeks ago, there was a similar 'Bet You Don't See...' item to Like. I had the impression it was going to be like the basketball/gorilla video, but it automatically invited all my friends, etc..there was no way (i could see) to not do it once you were sucked in.
I 'reported' it (although the Facebook 'report' button is entirely inadequate for this), and encouraged the friend i got this from to as well..
Why is this only coming up now? When i hit that page, it had already sucked in nearly 200,000 people. (ie, the number of 'Fans'.)
I saw a lot of my friends get hit by something just like it, including a rick-roll. Every one of them said they didn't click "like" on the rick-roll site, but it showed up as a like on facebook anyway. Who wouldn't be curious enough to want to click on a "FriendX likes you." link? Thankfully I have a habit of checking the URLs on unusual facebook links. The strange part was there were many different URLs for the "you", so it looked like a "distributed" attack (FB couldn't just search for one URL).
Out of curiosity, I opened the link in a separate browser without my Facebook login. It would then try to do a "security check" in which you have to answer a survey to prove that you're human. Being the smart Slashdotters we are, we know Captchas are how it's done. The main take-away: (1) Hover, look, and think before you click and (2) If the link goes outside Facebook, it is SPAM and should be reported.
There's something everyone can do to fix it for themselves, though: log off when you're done using Facebook. Of course, that makes it harder to tell your little friends about how you "heart" (sorry, Like) various things.
I'd rather you rationally disagree than irrationally agree.
Much simpler to abandon security-plagued Facebook, the Windows 98 of social networking sites (myspace would be the Windows 95 equivalent).
"I believe in Karma. That means I can do bad things to people all day long and I assume they deserve it." : Dogbert
While opening a bunch of feed items (including this one) which included several different websites, I was prompted to download "like.php" which is a kind of thing that happens when websites set bad headers...
None of my tabs failed to load, so I'm guessing this came from a rogue advert (?)
I don't have a facebook account though, so I'm not worried.
The Internet has given stupid people the resources of intelligent people.
They could have combined it with the "history stealing" exploit, registered domains bananas.com and peaches.com, and picked for each victim the "appropriate" site to like.
What qualifies as a bug is a known as a Shield insect. A shield insect is somewhat a kind of beetle that has ornate markings on its wing cases, specifically has a sucking mouth-part, may emit a foul odor when bothered, and is as diverse as either specializing carniverous acts of stalking prey to even communing with fellow herbivores to suck dry a non-fibrous stem of a plant. Carnivorous varieties of Shield bugs are obviously cannibalistic, while the herbivorous variety commune together like a bunch of stinkin' hippy gypsies. Bugs that aren't a variety of Shield are also seasonally aquatic, such are; Toebiters, Waterboatmen, Backswimmers, and Whirlygigs. Insects that are buglike in that they have a sucking mouth organ but without a Shielding wingcase is the everyday Aphid.
Look for Shield bugs on Daisies, or maybe Carnations.
I typed this all by myself, to bug you moaarrrrr.
It is also worth pointing out another Facebook exploit which allows a page to 'run' Javascript on a Facebook page. It prompts the user to perform certain actions which copy-and-paste a 'javascript:' style URL to the address bar, and to click Enter to execute the Javascript. This also has the potential to spread fast by sharing it with all of your friends. See http://infinity-infinity.com/2010/05/facebook-exploit-social-engineering-javascript-injection/.
I wonder what she told him in order for him to become his Sympathy-boyfriend. One does not blow bananas as a talent, it's a business...
If you think that'll work, you might want a look at this...
http://www.theonion.com/articles/entire-facebook-staff-laughs-as-man-tightens-priva,17508/
An iframe isn't an Apple product. It's an HTML tag. It's iframe.
But the hemipteran order goes through incomplete metamorphosis, not complete metamorphosis. So they never have a larval stage that looks anything like that.
What's that whooshing noise?
To solve problems like this. No matter what Mark Z decides to Zuckerpunch my privacy settings into tomorrow or the next time he secretly changes them, or not matter what bullshit he opts me into, the rest of my webbrowsing (slashdot and wikipedia) will remain separate from FB's braindead "features".
I already removed almost all my personal info of course, but facebook is simply too big to close completely. It would close off a useful service. Again, it's not that I object to FB trying to make a profit to support a free service, I expect that. It's that I don't like being tricked and worn down into doing things I don't want.
93rd rule of Slashdot: No matter how obvious my sarcasm is, my comment will be taken seriously by someone.
and replace it with ... ?
NB: The message above might reflect my opinion right now, but not necessarily tomorrow or next year.
Cellphone use gets rid of bees? Sweet! I have a couple of ground hives in the yard that need to go.
The most common suggestion I've gotten - gasoline....:(
And if they don't bring their site into compliance with Canadian Law, they get their loli-pop taken away.
If you hover first over the web page, you can see what is clickable and what is not, if the whole webpage looks like one big url link to be clicked, then flag goes up in MY head...so don't click, but i think with javascript there are ways to even eliminate the hover click icon for x, y position and make it avalable only between the points....i may be wrong though, my javascript is a bit rusty....i think it was a x , y point element you had to set....anyhow...still gives you a heads up if there was no real cover for that click link.
Anyone in /. get hit by this, would like to get that info if possible...
I want to know what domain to AdBlock on 3rd-party websites to block this sort of thing for good. Basically I want to disable all of Facebook’s javascripts that 3rd-party sites are trying to embed. If somebody knows off the top of their head, it’d be very helpful... but if not I guess I’ll have to figure it out myself. I’m not going to install NoScript, so don’t bother telling me to do that.
Fuck Facebook and its attempted invasion into every other part of my life. I like Facebook just fine but it isn’t an integrated part of my life and I only want to use it in the browser tab that actually has Facebook loaded up. It can keep the hell out of the rest of my tabs; when I want Facebook, I’ll find it – not the other way around.
Alexander Peter Kristopeit bought his basement from his mommy for one dollar.
It's not that simple. Several European countries have followed our lead, and if Facebook doesn't comply, they face sanctions - and as we've seen in the news lately, that includes having their plug pulled in various countries, which certainly will affect both their revenue and their valuation.
What's Facebook worth if Canada, Europe, and chunks of South America all pull the plug? Way less than half, because the "network effect" cuts both ways.
It opens the doors for competitors that have better privacy policies, and are available in more countries.