Slashdot Mirror
Clickjacking Worm Exploits Facebook "Like" Feature
An anonymous reader writes "For the last 24 hours, a series of attacks have exploited Facebook's 'Like' feature through a clickjacking vulnerability. Using subjects such as 'This Girl Has An Interesting Way Of Eating A Banana, Check It Out!' hackers have spread an attack that links to web pages that use invisible iFrames to trick users into saying they like the content. Users are presented with a innocent-seeming web page that says 'Click here to continue,' but clicking at any point on the page publishes the same message to their own Facebook page. Security blogger Graham Cluley says that hundreds of thousands of Facebook users have been hit, and offers advice on how to clean up affected Facebook profiles.
I hate posts without proper links...
So, who will post the direct link to the girl with an interesting way of eating a banana?
Violence is the last refuge of the incompetent. Polar Scope Align for iOS
after that article.
Why does the Slashdot section on worms have a picture of a crawling caterpillar?
Thank you NoScript for stopping this for me. I knew it looked "phishy."
Graham Cluley ... offers advice on how to clean up affected Facebook profiles
Here. I'll offer the simplest advice you can get: Stop clicking on stupid shit.
Just by doing that, internet/computer security would be vastly improved. Once all of our moms and computer-illiterate uncles learn that one little gem, we'll be a long ways towards solving most of the computer-related security issues. Of course there are steps after that to really nail down security but, until people stop clicking on stupid shit, we're fighting a losing battle.
If you click on his name, it shows he's one of those social media guys. "Slight" would be an understatement, and understandably - it's his job.
Plus, Facebook is in the news for its' privacy screw-ups. They have less than 3 months left in their deal with the Canadian government to bring their site into compliance with Canadian law (which is what got the whole "Facebook has a privacy problem" thing going 9 months ago, and got other governments to then launch similar probes).
and offers advice on how to clean up affected Facebook profiles.
No problemo, just click right here:
http://www.facebook.com/group.php?gid=16929680703
The title is "How to permanently delete your facebook account." Or, is it?
"Science flies us to the moon. Religion flies us into buildings." - Victor Stenger
The real problem isn't as much of an exploit so much as it is Facebook's platform for cross-site publishing is basically broken. They allow any site to act as the user with no confirmation other than a click, which as we've seen is easy to get via an invisible iFrame that follows the mouse. Aside from revamping the way they handle "Likes" and other such things on other sites, there's not much they can do to "fix" it.
Out of curiosity, I opened the link in a separate browser without my Facebook login. It would then try to do a "security check" in which you have to answer a survey to prove that you're human. Being the smart Slashdotters we are, we know Captchas are how it's done. The main take-away: (1) Hover, look, and think before you click and (2) If the link goes outside Facebook, it is SPAM and should be reported.
There's something everyone can do to fix it for themselves, though: log off when you're done using Facebook. Of course, that makes it harder to tell your little friends about how you "heart" (sorry, Like) various things.
I'd rather you rationally disagree than irrationally agree.
Much simpler to abandon security-plagued Facebook, the Windows 98 of social networking sites (myspace would be the Windows 95 equivalent).
"I believe in Karma. That means I can do bad things to people all day long and I assume they deserve it." : Dogbert