Facebook Malware Goes Viral

← Back to Stories (view on slashdot.org)

Posted by samzenpus on Sunday February 5, 2012 @05:12PM from the spreading-the-bad-news dept.

itwbennett writes "Just a few hours after a fake CNN news report appeared on Facebook Friday, more than 60,000 users had gone to the spoofed, malware bearing page according to Sophos Senior Security Advisor Chester Wisniewski. Facebook didn't respond to IDG News Service's request for information on 'how widespread the problem was or whether its own security had been breached, but Wisniewski said that there are a number of ways that status updates could appear without users' knowledge.'"

123 comments

Hopefully lots of stuff of value was lost by Khyber · 2012-02-05 17:14 · Score: 5, Insightful

Maybe that'll teach people to be more wary about random links they see.

--
Still waiting on Serviscope_minor to wake up to fucking reality and realize that Jessica Price isn't going to fuck him.
1. Re:Hopefully lots of stuff of value was lost by BitterOak · 2012-02-05 17:18 · Score: 1, Insightful
  
  Maybe that'll teach people to be more wary about random links they see.
  And I suppose you hope lots of houses burn down too, so that people will clean the lint traps in their dryers more frequently.
  
  --
  If I can be modded down for being a troll, can I be modded up for being an orc, or a balrog?
2. Re:Hopefully lots of stuff of value was lost by slackware+3.6 · 2012-02-05 17:22 · Score: 0
  
  Well they have not learnt yet. So I doubt this taught them anything. Or like my stupid relatives that keep falling for your computer is infected with *random crap* please enter your credit card to remove *random crap*. A co worker even fell for it and he was using Ubuntu 7.10 If I remember.
3. Re:Hopefully lots of stuff of value was lost by Anonymous Coward · 2012-02-05 17:25 · Score: 0, Funny
  
  Nope they better check to make sure their firewalls are up to date didn't you hear them computer hackers can turn your computers into some of them fancy bombs just by connecting to this "net" infrastructure thing they got going on created by this Al Gore guy. Bet he's real sorry now, I just saw him on FOX and I bet he is on them there top ten wanted list, not quite sure as I was too busy cleaning this here gun and dang near forgot to turn on the safety. Funny thing is them things can go off sometimes when you clean them, no one quite knows why.
4. Re:Hopefully lots of stuff of value was lost by bogaboga · 2012-02-05 17:26 · Score: 5, Insightful
  
  Maybe that'll teach people to be more wary about random links they see.
  Some people might call you a sadist, unfortunately. In my case though, I hope Slashdot will not 'force' us to use Facebook login...or whatever they call it.
  This is because I do not have a Facebook account and do not intend to get one. Do not call me weird. People at work have called me names for not having a Facebook account.
  Here is my reason for not having one: Having a Facebook account adds no value to me at all, save for inviting unwanted folks I have always loved to avoid into my life. Besides, I am too busy for Face-book anyway.
5. Re:Hopefully lots of stuff of value was lost by Anonymous Coward · 2012-02-05 17:26 · Score: 1
  
  Well people dont even on sites that claim to be "superior' sites like Slashdot. This is why the Goatse trolls are still in business and have massive lemon parties every week.
6. Re:Hopefully lots of stuff of value was lost by mikeburke · 2012-02-05 17:36 · Score: 5, Insightful
  
  Besides, I am too busy for Face-book anyway.
  Yes, these posts on Slashdot will wait for no man... can't these people see I'm busy?
7. Re:Hopefully lots of stuff of value was lost by mlts · 2012-02-05 17:46 · Score: 4, Interesting
  
  When I was in the job market, I lost potential jobs for not having a FB account.
  With the fact that there is concern about deleted stuff not really being deleted, people searching profiles for anything (where a bad joke reposted can get someone flagged as a racist or gun nut for 7 years), using FB as a communication tool for anything other than the latest cat meme is out of the question.
  I sometimes wonder about someone coming up with a paid membership site (so the subscribers are the true customers) for social networking where only the parties involved (and possibly LEOs) are the only ones privy to information posted and shared. Combine that, plus having data erased after a forensically apt period of time (30 days after it was deleted by the user), and this would be an actually useful service.
8. Re:Hopefully lots of stuff of value was lost by tlhIngan · 2012-02-05 18:39 · Score: 5, Insightful
  
  When I was in the job market, I lost potential jobs for not having a FB account.
  With the fact that there is concern about deleted stuff not really being deleted, people searching profiles for anything (where a bad joke reposted can get someone flagged as a racist or gun nut for 7 years), using FB as a communication tool for anything other than the latest cat meme is out of the question.
  So use Facebook as I use it - very carefully.
  I put up a very minimal profile (Facebook may ask for a ton of information, but they require very little). Put up a neutral profile pic, and don't bother uploading any more photos.
  Then accept friends with caution. There is no law saying you have to friend every real life friend on Facebook. I don't - in fact, I have probably 8-10 people on my "requesting to friend you" list. They are people I know in real life, but to whom I don't really care about. No one said you have to have a million "friends" in your friend list, or accept every invitation.
  I also set all the controls so my friends can't do anything like tag me or such. And I don't post my every whim/though/status update there. Actually, I don't bother posting at all - it's just a token account I use to control my online identity. (I also don't spend more than a few minutes every few months).
  There's no reason one can't have a facebook account, nor any law requiring one spend hours on the site - just set up a minimal profile, carefully choose your friends, and watch what you post (remember that everything you post online the entire world can see, regardless of privacy settings - so treat every post as a public blog post or comment on a website that everyone can see).
  The real challenge though is the dancing pigs problem, which most people on facebook seem vulnerable to.
9. Re:Hopefully lots of stuff of value was lost by debiankicksass · 2012-02-05 18:58 · Score: 2
  
  I prefer real friends myself and therefore do not have a facebook either.
10. Re:Hopefully lots of stuff of value was lost by rhook · 2012-02-05 19:26 · Score: 5, Funny
  
  I have a bridge for sale in Brooklyn that they might be interested in. Cheap.
11. Re:Hopefully lots of stuff of value was lost by Anonymous Coward · 2012-02-05 20:20 · Score: 0
  
  posting to remove my error in moderation
  And someone else just couldn't stand not burning up on one of their own mod points to keep yours company.
  It is the correct thing to do, since his post was off-topic, as was yours (and mine also but I'm posting AC on purpose). Slashdot is all about the comments and the discussion and moderating off-topic comments down is not a bad thing. Technically, if you mis-moderate and want to cancel it then you don't need to post a reply to the comment that you moderated, you just need to post a comment to the discussion. Reply to the story and your moderation will be cancelled, but your comment will appear down at the bottom and nobody will care about it, since if the story is popular it will be pushed off the front page pretty quickly. Nobody wants to read "posting to remove mis-moderation" at the top of the front page, mongchops.
12. Re:Hopefully lots of stuff of value was lost by Anonymous Coward · 2012-02-05 20:35 · Score: 0
  
  They're your mod points--waste 'em any way you like. Just so we don't have to fucking hear about it.
  (Can someone please mod the parent down? I'm sure he'd agree it was the right thing to do. Thanks!)
13. Re:Hopefully lots of stuff of value was lost by Anonymous Coward · 2012-02-05 20:36 · Score: 5, Insightful
  
  Maybe that'll teach people to be more wary about random links they see.
  Not really directed at you, as such, but... When did we accept that clicking on a link is a dangerous operation? I mean, sure, there's a risk you might end up at goatse or whatnot, but are browsers and web devs really so utterly incompetent that simply fetching a page from a dubious domain counts as head-slapping user error? It's really not that long since browsing the web was fairly safe, at least to the extent that if you didn't download and run random .exes it wouldn't break your computer. Most users expect that it still is and, frankly, they're right to have that expectation.
  Or, to put it another way: the user can bork your security model just by clicking on a link, the problem is with the security model rather than with the user.
14. Re:Hopefully lots of stuff of value was lost by hairyfeet · 2012-02-05 20:43 · Score: 3, Insightful
  
  Maybe it will also teach them to have a browser that actually blocks that crap like Comodo Dragon, along with having a good free AV like Avast or Comodo that will sandbox and try to minimize their own rampant stupidity?
  Just another example of what I predict all malware of the future will be, simple social engineering to exploit the PEBKAC for personal gain. Frankly here at the shop i can't even remember the last time i saw a malware driveby bug, even on XP, its all PEBKAC trolling now. The truly sad part is no matter how many times you warn them there are a percentage that will ignore you or even be downright hostile to you if you try to keep them from getting infected if it involves them not getting the real or imagined cookie the malware writers offer. I have seen this myself when i threatened to call the cops and had to throw a guy out of my shop for wanting his PC fixed for free after he got infected not 24 hours after getting it from me. What did I do wrong to cause such a short turnaround? not a damned thing, after i told the guy that Limewire had been shut down by the feds years ago and anything calling itself "the new limewire" would just be a virus he went home and when his AV wouldn't let him have his "New limewire" he first tried disabling it and then uninstalled it, all so he could have a fake limewire that was nothing but a trojan delivery package.
  When you are dealing with THAT level of stupid selfcenteredness frankly it doesn't matter if it is Windows or Linux, if its Android or iOS, all you have to do is dangle the right cookie in front of their faces and they will be downright hostile to anything that tries to keep them from their goal, no matter how many time you expressly warn them that the only cookie they'll be getting is some malware writer blowing his cookies all over their computer. But as long as the user has the rights to control his system you will be dealing with a section of them that don't think, a section of them that are downright greedy and will fall for anything that appeals to that greed, a section of them that only think with the little head that will happily do anything you want as long as your offer includes their fetish, and finally a section of users that are just DUMB, stupid ignorant, clueless and have no intention of learning shit, just good old fashioned idiots.
  this is a perfect example, how many times have we seen this exact same shit pulled? How many times has FB warned them about just clicking on random shit that asks them to install anything? yet here we are, thousands of machines pwned by people so fucking retarded they probably shouldn't have been on them in the first place.
  
  --
  ACs don't waste your time replying, your posts are never seen by me.
15. Re:Hopefully lots of stuff of value was lost by Anonymous Coward · 2012-02-05 21:35 · Score: 0
  
  sure, if they're facebook users.
16. Re:Hopefully lots of stuff of value was lost by flimflammer · 2012-02-05 21:36 · Score: 4, Interesting
  
  If you lost potential jobs by not having a facebook account, then you did not want to work there anyway. They just wanted you to do their research for them by divulging every detail of your life on facebook so they could go through it and nitpick every little comment and picture in your account.
17. Re:Hopefully lots of stuff of value was lost by flimflammer · 2012-02-05 21:43 · Score: 1
  
  Having a bad day?
18. Re:Hopefully lots of stuff of value was lost by Anonymous Coward · 2012-02-05 21:49 · Score: 0
  
  Maybe that'll teach people to be more wary about random links they see.
  Not only that, but I have a feeling most of those 60K people either have an axe to grind with Obama, or with the US in general, and are desperately seeking reinforcement of any batshit crazy idea that gets reported.
19. Re:Hopefully lots of stuff of value was lost by Dunbal · 2012-02-05 23:03 · Score: 1
  
  Quick, buy facebook stock!
  
  --
  Seven puppies were harmed during the making of this post.
20. Re:Hopefully lots of stuff of value was lost by TheDarkMaster · 2012-02-05 23:04 · Score: 1
  
  Do you accept checks? :)
  
  --
  Religion: The greatest weapon of mass destruction of all time
21. Re:Hopefully lots of stuff of value was lost by Lumpy · 2012-02-05 23:36 · Score: 4, Funny
  
  "Maybe that'll teach people to be more wary about random links they see."
  No, no it wont. I have worked in IT for 12 years and was happy to escape it 6 years ago. I still see that even today, the average user gleefully clicks on any link they see. I think most users think the internet is a giant game of whack a mole.
  
  --
  Do not look at laser with remaining good eye.
22. Re:Hopefully lots of stuff of value was lost by MysteriousPreacher · 2012-02-06 00:35 · Score: 3, Insightful
  
  Or it's their preferred medium for contact/managing relationships. Another possibility is that it's just be one an expectation - like having an email address, website, business card or fax number would have been.
  I personally don't like this. Facebook for me is a personal thing, not something I'd like to use for business. If they ask Facebook, I'd have to ask why? If its for contact, then use email, phone or LinkedIn, or smoke signals for all I care. Thry may just as well be asking for my girlfrirnd's mobile number.
  
  --
  -- Using the preview button since 2005
23. Re:Hopefully lots of stuff of value was lost by azalin · 2012-02-06 01:29 · Score: 2
  
  Amen. If just clicking a link (compared to "do you really want to install this potentially dangerous software") results in an infection there is something deeply wrong. Browsers (or even the Fb API) should shield users from something like this, or be considered defective.
  I have seen parts of the internet where normal eye bleach wouldn't have helped anymore, but if we couldn't just go out and explore, the web wouldn't be the same anymore.
  Of course once users carelessly click through the warnings, it's time for the iron cluebat.
24. Re:Hopefully lots of stuff of value was lost by Anonymous Coward · 2012-02-06 01:34 · Score: 0
  
  "posting to remove my error in moderation" type posts take less than 1/2 a sec to skip over. I've accidentally up-ranked a troll because of a miss-click, more than once.
  Someone tries to correct a mistake and you think they should be punished. I would hate to be one of your kids.
25. Re:Hopefully lots of stuff of value was lost by azalin · 2012-02-06 01:42 · Score: 1
  
  of course anyone clicking "update flash player" from any other location than the original website deserves it.
26. Re:Hopefully lots of stuff of value was lost by Anonymous Coward · 2012-02-06 01:52 · Score: 0
  
  Wow, I didn't think there was anyone else out there like me...
27. Re:Hopefully lots of stuff of value was lost by Anonymous Coward · 2012-02-06 02:40 · Score: 0
  
  You haven't searched for work in this economy. Yes, there are employers who don't care what their employees do in their spare time, but their positions are usually obtained by word of mouth. First class employers usually have their workers either via internships, or the good ol' boy network. By the time stuff gets to the headhunters or the job sites, it is usually the picked over jobs; the jobs that the chat at the local watering hole can't fill, and they can't find anyone with the most important certification that is needed in the workforce to hire [1]. These are jobs that either require special expertise (Solaris, AIX or other production operating systems, Linux certs like the RHCE are worthless unless you want a 24/7 tech support job at some ISP for minimum wage.)
  So, usually you will get the employers who now have a stack of hundreds to thousands of candidates for a position. By demanding FB info, it is a filter. Plus, they can filter people who might be "deviant" (nightclub DJ, tattoo artist) and not up to corporate PR standards. Remember: In this economy, even Wally World has a line going around the building for a greeter position.
  [1]: Ralistically, most certs ( CCIE, CISSP, MC-ITP, et. al.) come secondary to the one qualification that employers care about: The H-1B.
28. Re:Hopefully lots of stuff of value was lost by Anonymous Coward · 2012-02-06 03:09 · Score: 0
  
  Last I heard, Facebook is Malware. A great information sieve that sells your identity to the highest bidder.
29. Re:Hopefully lots of stuff of value was lost by Roberticus · 2012-02-06 03:16 · Score: 1
  
  Link?
30. Re:Hopefully lots of stuff of value was lost by flimflammer · 2012-02-06 03:31 · Score: 1
  
  That was my whole point; they want to use it to analyze your life. It's basically a gold mine of information regarding your potential hire. However filtering out people completely who don't have it is lazy. Not everyone wants to broadcast their life online, and it makes little sense to force them to just to save yourself some time. Facebook is not the only way to find information on potential hires.
  I will never agree with a filter based on whether or not someone has Facebook or not.
31. Re:Hopefully lots of stuff of value was lost by AverageWindowsUser · 2012-02-06 03:52 · Score: 1
  
  Isn't it odd that sending emails is free, yet wire-transfers cost a fee? I think email communications are more processor intensive than the latter. Tally Ho Old Chaps!
32. Re:Hopefully lots of stuff of value was lost by ahadley · 2012-02-06 04:01 · Score: 1
  
  It would seem like an amusing moment to prove the point by offer a slightly obscured link to goatse... but I can't bring myself to check if it still exists... anyone brave around?!
33. Re:Hopefully lots of stuff of value was lost by TheDarkMaster · 2012-02-06 04:02 · Score: 1
  
  Not exactly. Send an e-mail is not free, you need to pay an internet connection to do that. Wire-transfer is more or less the same thing, but you pay for sending service instead of paying to access the transmission medium.
  
  --
  Religion: The greatest weapon of mass destruction of all time
34. Re:Hopefully lots of stuff of value was lost by iMadeGhostzilla · 2012-02-06 04:22 · Score: 1
  
  To be more precise, you *imagine* that having a FB account adds no value to you at all. You ran a quick simulation in your head in which the experience felt awful and without value, and you decided that such would be the reality if you were on FB.
  But humans are notoriously bad about mentally simulating the future in order to find out how they'd feel, for nontrivial things. (Lots of good research on that one.) So if lots of your friends and peers tell you the experience is not bad, there's a good chance you're wrong.
35. Re:Hopefully lots of stuff of value was lost by AverageWindowsUser · 2012-02-06 04:39 · Score: 0
  
  Email is free for inner city black men with Library Cards.
36. Re:Hopefully lots of stuff of value was lost by Anonymous Coward · 2012-02-06 04:55 · Score: 0
  
  You are not alone. Billions of us do not have a facebook account.
37. Re:Hopefully lots of stuff of value was lost by operagost · 2012-02-06 05:00 · Score: 2
  
  Why the hell would a redneck use the word "infrastructure"? And having the safety on while cleaning your gun is like putting your car in park before you remove the transmission.
  
  --
  
  Gamingmuseum.com: Give your 3D accelerator a rest.
38. Re:Hopefully lots of stuff of value was lost by Anonymous Coward · 2012-02-06 06:05 · Score: 0
  
  Someone tries to correct a mistake and you think they should be punished.
  Well, I don't have any kids so you'd be out of luck.
  But listen, moderation is not punishment or reward for users of the site, it is to shape the discussion, to lessen the visibility of troll and offtopic comments, to increase the visibility of insightful, informative, interesting or funny comments. The moderation we have here is what makes slashdot interesting, because otherwise we would be drowned in trash. That your karma may change is just a side effect (and note, that even with great karma, you only get a +1 boost.. plenty of AC comments are moderated up)
  And if you don't like the way that slashdot provides a shaped discussion, you can log in and reshape it how you want based on the moderations that exist (or just read at -1 if you can stand the GNAA trolls)
39. Re:Hopefully lots of stuff of value was lost by Khyber · 2012-02-06 06:25 · Score: 1
  
  "When did we accept that clicking on a link is a dangerous operation?"
  Drive-by malware. Duh.
  
  --
  Still waiting on Serviscope_minor to wake up to fucking reality and realize that Jessica Price isn't going to fuck him.
40. Re:Hopefully lots of stuff of value was lost by Anonymous Coward · 2012-02-06 06:45 · Score: 0
  
  Get over it, bitch. I have that picture as my wallpaper. On my media center box. In the living room.
41. Re:Hopefully lots of stuff of value was lost by John+Hasler · 2012-02-06 07:14 · Score: 1
  
  > ...for nontrivial things.
  But we're talking about Facebook.
  
  --
  Warning: this article may contain humor, sarcasm, parody, and perhaps even irony. Read at your own risk.
42. Re:Hopefully lots of stuff of value was lost by John+Hasler · 2012-02-06 07:16 · Score: 1
  
  When did we accept that clicking on a link is a dangerous operation?
  
  When you started using Microsoft Windows.
  
  --
  Warning: this article may contain humor, sarcasm, parody, and perhaps even irony. Read at your own risk.
43. Re:Hopefully lots of stuff of value was lost by Darinbob · 2012-02-06 07:40 · Score: 1
  
  Seriously what kind of job or company would require having an FB account, even if only for an interview? Not everyone has one and an employer would have to either be idiotic to not know this or be 13 years old. People avoid FB on purpose.
44. Re:Hopefully lots of stuff of value was lost by Anonymous Coward · 2012-02-06 08:23 · Score: 0
  
  You're kind of talking about LinkedIn, which offers free user accounts, but if you really want to get the most out of it, you should purchase the paid subscription, which opens up a lot more networking tools for you. LinkedIn is particularly useful for recruiters, so if you're in the job market, you are much better served by a LinkedIn profile than a Facebook page.
45. Re:Hopefully lots of stuff of value was lost by _0xd0ad · 2012-02-06 08:43 · Score: 1
  
  I use Adblock Plus.
  ||facebook.com^$third-party,domain=~facebook.net|~fbcdn.com|~fbcdn.net
  ||facebook.net^$third-party,domain=~facebook.com|~fbcdn.com|~fbcdn.net
  ||fbcdn.com^$third-party,domain=~facebook.com|~facebook.net|~fbcdn.net
  ||fbcdn.net^$third-party,domain=~facebook.com|~facebook.net|~fbcdn.com
  Nothing else on the web can even tell that Facebook's servers exist, unless I write it an exception. Grooveshark even pops up a little message to warn me of this.
46. Re:Hopefully lots of stuff of value was lost by rsborg · 2012-02-06 09:14 · Score: 1
  
  I also set all the controls so my friends can't do anything like tag me or such. And I don't post my every whim/though/status update there. Actually, I don't bother posting at all - it's just a token account I use to control my online identity. (I also don't spend more than a few minutes every few months).
  Another thing you might want to do is to not only restrict all information to "self" as opposed to "friends" or "public" is to enter false information. I call this my "fakebook" data, and was surprised (when facebook reset it's privacy rules like they do occasionally) when I got tons of "happy birthday" wall postings (and subsequent notification spam) on some random date (which is what I falsely entered in facebook).
  However, ultimately, this is not the problem. Zuckerberg and many others know that the really valuable data are the connections (graph). The fact that facebook constantly pesters you to extend your graph is reason enough to believe it's valuable to them that you're further ensnared. Even a single connection is a way to trace you. Unfortunately, I'm ensared when it comes to this, and thus despite my "fakebook" data and faceblocker browser-plugins, I'm contributing to their collective assets.
  
  --
  Make sure everyone's vote counts: Verified Voting
47. Re:Hopefully lots of stuff of value was lost by Anonymous Coward · 2012-02-06 10:02 · Score: 0
  
  I dunno about you, but arranging anything other than a tiny event... inviting people, disseminating information, giving updates of times/food/etc... the difference between doing that on facebook versus doing it by live contact or telephone (since a large number of people nowadays don't even use email any more)... I'd say that's nontrivial to me.
  You want to spend time phoning 50 people, leaving voicemails, following up with those you couldn't get through to, etc, etc, and repeat that for any important changes, be my guest. I however will make a facebook event in 5 minutes, and post any updates in 20 seconds... of which gets through to 99% of the people invited (the other 1% being people without facebook... significantly easier to work with).
  Say it's more impersonal or what have you, but I've got a lot better things to do than spend hour after hour on the telephone.
48. Re:Hopefully lots of stuff of value was lost by knorthern+knight · 2012-02-06 14:38 · Score: 1
  
  > ||facebook.com^$third-party,domain=~facebook.net|~fbcdn.com|~fbcdn.net
  > ||facebook.net^$third-party,domain=~facebook.com|~fbcdn.com|~fbcdn.net
  > ||fbcdn.com^$third-party,domain=~facebook.com|~facebook.net|~fbcdn.net
  > ||fbcdn.net^$third-party,domain=~facebook.com|~facebook.net|~fbcdn.com
  I firewall Fecesbook on my home PC. Here are their known address blocks in CIDR and range formats...
  66.220.144.0/20 66.220.144.0 - 66.220.159.255
  69.63.176.0/20 69.63.176.0 - 69.63.191.255
  69.171.224.0/19 69.171.224.0 - 69.171.255.255
  74.119.76.0/22 74.119.76.0 - 74.119.79.255
  173.252.64.0/18 173.252.64.0 - 173.252.127.255
  204.15.20.0/22 204.15.20.0 - 204.15.23.255
  
  --
  
  I'm not repeating myself
  I'm an X window user; I'm an ex-Windows user
49. Re:Hopefully lots of stuff of value was lost by Anonymous Coward · 2012-02-06 14:55 · Score: 0
  
  jesus christ the lord.
  jesus our lord and father.
  brooklyn bridge for sale.
50. Re:Hopefully lots of stuff of value was lost by Anonymous Coward · 2012-02-06 14:58 · Score: 0
  
  When did we accept that clicking on a link is a dangerous operation?
  It's called cross site request forgery. Evil page just inserts a link like [a href="http://www.facebook.com/deleteMyAccount"] Free Pr0n! [/a] and when you click it, you execute the link with your cookie and your logged in level of permissions. Even an img tag could do it [img src="http://facebook.com/acceptFriendRequest?user=evilDude"/]. Your browser will load it with the page.
  We accepted it all the way back when Netscape introduced cookies as a way to track session state. Some web frameworks have built in protection against this sort of attack. Apple's WebObjects, for instance, has component action urls that are generated server side and are unique to the session/page. There's absolutely no way to forge one, because the url is generated at runtime and stored with the code that it executes.
51. Re:Hopefully lots of stuff of value was lost by mortonda · 2012-02-07 11:36 · Score: 1
  
  More to the point, having your gun loaded while cleaning is like trying to change the fan belt while the car is running...
52. Re:Hopefully lots of stuff of value was lost by operagost · 2012-02-09 04:49 · Score: 1
  
  Challenge ACCEPTED!
  
  --
  
  Gamingmuseum.com: Give your 3D accelerator a rest.
Windows malware doesn't go viral by dgharmon · 2012-02-05 17:26 · Score: 2

Technically speaking malware can't go viral, as in malware requires action by the enduser. It should be pointed out that only users of Facebook and 'Adobe Flash` running on Microsoft are suseptable to this vulnerability.

--
AccountKiller
1. Re:Windows malware doesn't go viral by Anonymous Coward · 2012-02-05 17:28 · Score: 2, Insightful
  
  does a viral video not also require some action by the end-user?
2. Re:Windows malware doesn't go viral by DI4BL0S · 2012-02-05 17:44 · Score: 1
  
  It should be pointed out that only users of Facebook and 'Adobe Flash` running on Microsoft are suseptable to this vulnerability.
  If these users don't already by default black plug-ins from running, but then again I would think those are the users that do not click random links
3. Re:Windows malware doesn't go viral by dgharmon · 2012-02-05 17:47 · Score: 1
  
  "does a viral video not also require some action by the end-user?
  
  In that case the video isn't a virus or even malware, more like a social engineering exploit. Technical terms have a more rigid definition that language used in casual conversion. I have seen the terms virus, worm and malware mixed-up, even in technical reports.
  --
  
  "When I use a word, it means just what I choose it to mean"
  
  --
  AccountKiller
4. Re:Windows malware doesn't go viral by bmo · 2012-02-05 18:03 · Score: 5, Insightful
  
  >It should be pointed out that only users of Facebook and 'Adobe Flash` running on Microsoft are suseptable to this vulnerability.
  Actually, it's the people in the Windows world who have been taught by the likes of Adobe and such that the normal way to install software is when you encounter a site that requires some special codec, that you install it straight away without question.
  Flash itself is not the problem, it's the behavior of users who have been taught wrong in the Windows universe.
  In sane environments, you look for trusted sources for software before blindly clicking on a web page. The Free Software world teaches people to look in the trusted repositories first (bsd ports system, debian packages, gentoo portage, etc) before downloading random binary code and running it willy-nilly.
  --
  BMO
5. Re:Windows malware doesn't go viral by perryizgr8 · 2012-02-05 20:08 · Score: 0
  
  it should be pointed out that a similar thing is happening in android with regards to app permissions.
  
  --
  Wealth is the gift that keeps on giving.
6. Re:Windows malware doesn't go viral by ShakaUVM · 2012-02-05 20:52 · Score: 1
  
  Eh, there's a fair amount of pushback on this.
  Was looking at getting a dice roller on my phone, and one of the free apps I was looking at had a number of 1-star ratings because the dice roller needed access to dialing out, the internet, and who-knows-what-else.
  The author of the app just put up an apologetic, "We need all those permissions on this app to get Google Ads to work", without bothering to fix the underlying cause. He didn't need all the permissions he was asking for.
  A friend of mine gave an interesting talk on the subject of Android security at Defcon:
  https://media.defcon.org/dc-19/presentations/O'Neil-Chin/DEFCON-19-O'Neil-Chin-Google-Android.pdf
7. Re:Windows malware doesn't go viral by Anonymous Coward · 2012-02-05 22:04 · Score: 1
  
  Technically speaking malware can't go viral, as in malware requires action by the enduser.
  It is sad that you even got a single upvote.
  Malware is a generic term used for ANY kind of malicious software. Malware which requires user interaction is called a Trojan Horse. A Virus is malware which spreads copies of itself by attaching or otherwise altering code in other applications. A Worm is malware which will replicate itself by mean other than "infecting" an existing file, and instead of making copies will 'move' itself to different locations. There are other types including rootkits, logic bombs, and more. And these days, many types of Malware are a hybrid or combination of one or more of the above methods.
  
  It should be pointed out that only users of Facebook and 'Adobe Flash` running on Microsoft are suseptable to this vulnerability.
  Apple's Marketing group uses the narrow definition of Virus, knowing that most people see that word and think "malware" instead. The most common form of malware on ANY platform these days is a Trojan, which then usually drops a rootkit, keylogger, and/or other types of malicious software.
  From the article:
  
  "The malware - which Sophos detects as Troj/Rootkit-KK - drops a rootkit called Troj/Rootkit-JV onto your Windows computer. In addition, Sophos detects the behaviour of the malware as HPsus/FakeAV-J.
  
  The delivery mechanism is a Trojan, which ANY platform is at risk from. In this specific case, the payload it drops only targets Windows systems. But by the time I typed this, whoever launched the site could have easily added a version to target Mac, Linux, or any other OS.
  Don't be a fool- Malicious Software is a very real risk on ALL platforms, not just Windows.
Clicking links! by sd4f · 2012-02-05 17:32 · Score: 2

It would be terribly ironic if the links in the post went to said malware sites. Getting more and more happier that i don't use facebook anyway. The problem i have though, a lot of malware is obvious that it's malware, usually by disabling you from doing certain things, like viewing hidden files, or even letting you run process explorer (which has helped me overcome virus' in the past, enough so that i could backup stuff and reinstall the OS) but what i'm worried about are the virus' which don't show themselves, considering the bad virus' i've gotten in the past have ranged from suspect sites, to trusted sites that became hacked and had the malware loaded on.
1. Re:Clicking links! by Anonymous Coward · 2012-02-05 18:28 · Score: 0
  
  It would be terribly ironic if the links in the post went to said malware sites.
  Nah, this is /. - those who don't use Chromium use Lynx.
2. Re:Clicking links! by semi-extrinsic · 2012-02-05 20:34 · Score: 1
  
  Meh. Lynx is for old farts, we use Uzbl instead - the only browser that adheres to the Unix philosophy of "Do one thing, and do it well". If I want pure text, I browse gophernet, which gives me the infinite speed I expect.
  
  --
  for i in `facebook friends "=bday" 2>/dev/null | cut -d " " -f 3-`; do facebook wallpost $i "Happy birthday!"; done
It must be hell out there, with that weather... by SeaFox · 2012-02-05 17:38 · Score: 5, Funny

Was anyone else amused the news article is titled "U.S. Attacks Iran and Saudi Arabia", but the video thumbnail shows tanks driving through snow?
1. Re:It must be hell out there, with that weather... by Anonymous Coward · 2012-02-05 18:15 · Score: 5, Funny
  
  It's not snow but rather, cocaine. Explains the madness going on in those countries.
2. Re:It must be hell out there, with that weather... by Mnicus · 2012-02-05 19:55 · Score: 1
  
  Was anyone else amused the news article is titled "U.S. Attacks Iran and Saudi Arabia", but the video thumbnail shows tanks driving through snow?
  While I too found this observation funny, they sometimes do have "winters" in Iran. Google "snow in Tehran" for collection of beautiful pictures.
3. Re:It must be hell out there, with that weather... by Pieroxy · 2012-02-05 22:12 · Score: 1
  
  Was anyone else amused the news article is titled "U.S. Attacks Iran and Saudi Arabia", but the video thumbnail shows tanks driving through snow?
  Well, no. Maybe because it's winter out there too, so snow is to be expected.
  
  --
  Write boring code, not shiny code!
4. Re:It must be hell out there, with that weather... by SeaFox · 2012-02-06 00:02 · Score: 1
  
  Well, there's also the stop sign at the corner of the street, too.
Bad advice in article by Nebulo · 2012-02-05 17:39 · Score: 5, Insightful

The article states, "Of course there is no such Flash update. You should always download Flash from a genuine Adobe site."
This is poor advice. I would suggest, "Flash should never be installed on anyone's computer, ever."
nebulo
1. Re:Bad advice in article by perryizgr8 · 2012-02-05 20:12 · Score: 2
  
  and youtube can go fuck itself, right?? because the html5 player still can't play shit, even on chrome.
  
  --
  Wealth is the gift that keeps on giving.
2. Re:Bad advice in article by Pieroxy · 2012-02-05 22:10 · Score: 1
  
  "Flash should never be installed on anyone's computer, ever."
  Let alone anyone's phone !
  
  --
  Write boring code, not shiny code!
3. Re:Bad advice in article by satuon · 2012-02-05 23:12 · Score: 2
  
  Actually that's not true. At least on Chrome, Youtube's HTML5 has true fullscreen (finally). I had been expecting them to do it since they own both Youtube and Chrome, so they can work on both sides of the equation. Now when you click the fullscreen button, the browser also goes fullscreen (as if you also hit F11). This makes HTML5 for all practical purposes equivalent to Flash, now.
4. Re:Bad advice in article by perryizgr8 · 2012-02-06 00:29 · Score: 1
  
  seeking does not work. it starts buffering again from the point you seek to, which is completely annoying because it takes time to buffer hd streams. the reality is that right now, flash is miles ahead of anything else for the purposes of streaming video over the net. for example, look at any of youtube's live streams, all sorts of auto-bandwidth shit goes on in the background and the video quality varies seamlessly without any annoying breaks. ditto south park studios.
  also, i hate not being able to control the loadingof the video in html5. for flash, i just put all plugins in 'click to play'.
  
  --
  Wealth is the gift that keeps on giving.
5. Re:Bad advice in article by azalin · 2012-02-06 01:35 · Score: 1
  
  That's exactly what the late Steve used to say
6. Re:Bad advice in article by Darinbob · 2012-02-06 07:48 · Score: 1
  
  Well, ya, I guess people can skip youtube also without their lives coming to an end.
7. Re:Bad advice in article by Anonymous Coward · 2012-02-06 08:56 · Score: 0
  
  Well, while Google does own YouTube, they technically do not "own" Chromium, which is an open source project. They've taken the Chromium browser code and customized it for their own purposes to promote their Chrome Browser (and ChromeOS) as Google branded products. You can download several other Chromium-based browsers (e.g., SRWare Iron, Comodo Dragon, ChromePlus, Rokmelt, CoolNovo, etc.), which have the advantage of better security as well as better privacy controls, since none of these browsers automatically send your history, metrics or cookie information to Google. I use Iron myself and I love it.
Oh look a ticket came in..... by Anonymous Coward · 2012-02-05 17:39 · Score: 0

I know what piece of shit I'm cleaning of the user's machines in the morning!
Those wily fb links by tkprit · 2012-02-05 17:50 · Score: 5, Insightful

Bitches are getting good! If I see an interesting link on FB that hasn't popped up in my reader, I go to the source site and try to find the linked article myself because, well, it's FB. But I noticed a crazy-sounding headline from The Washington Post, went to the wp site, never found it, went back to fb and hovered over the link, ready to warn the friend that they'd clicked the wrong link — hoverlink pointed to trove.fb.xxxxxxx (one of those apps for "social sharing" every 'article' you read in the app). I didn't allow the app, of course, but the headline being on the WP bugged me; back on wp.com, I finally found a barely-related article that had a sentence buried deep inside it that alluded to the sensationalistic headline linked on fb. I should have known: the Post dumbs down the articles for fb (why would anyone want to admit to reading the dumbed-down versions?).
.
These apps are hell! Why not just go to the WP and read the whole article there? It's like AOL came back from the 90s, bigger and badder (content not served to you; you have to beg for it by approving each 'app', and then you just get a morsel instead of the whole content). And ppl want this?!
Fine; let em have it. I now officially support these fb malware apps — funny to watch in action, and maybe enough of them will teach people not to use these 'apps'. And booyah on the Post for succumbing to the dumbing down of content to feed the masses.
1. Re:Those wily fb links by k6mfw · 2012-02-05 18:45 · Score: 2
  
  > It's like AOL came back from the 90s, bigger and badder
  At least AOL sent 3.5" disks that could be used storage (tape write-protect hole) or as coasters for beverages.
  But seriously, "alpha hotels" can post dangerous wily links and with zillion people on FB, all it takes is 0.001% to fall for it and there will be large numbers of computers will be inflicted. This has potential to spread and cause havoc.
  I use one computer for online stuff, other machines ain't know way ever connect them to the 'net. Did you know Windows XP will never crash as long as you don't connect it to the internet. And also don't load it with a bunch of crapola programs. I know of one system that is running for years (at work for a special application and only three machines are networked together). Damn thing keeps running.
  
  --
  mfwright@batnet.com
2. Re:Those wily fb links by Zontar+The+Mindless · 2012-02-05 19:22 · Score: 1
  
  These apps are hell! Why not just go to the WP and read the whole article there? It's like AOL came back from the 90s, bigger and badder (content not served to you; you have to beg for it by approving each 'app', and then you just get a morsel instead of the whole content). And ppl want this?!
  Because it'll be more like their smartphones (and EVERYBODY knows we now want our desktops and laptops to look and act just like our phones, even Microsoft!), despite the fact that having a separate "app" for every content provider is anything but smart.
  Unless you're just looking for (more) ways to extract rents from people while you're merrily leading them down the primrose path to AOL ca. 1992... or Apple ca. 2012...
  
  --
  Il n'y a pas de Planet B.
3. Re:Those wily fb links by Anonymous Coward · 2012-02-05 20:01 · Score: 0
  
  I miss the time period between "AOL keyword [name]" and the now-standard "Facebook.com/[name]"
4. Re:Those wily fb links by Anonymous Coward · 2012-02-06 05:56 · Score: 0
  
  > Did you know Windows XP will never crash as long as you don't connect it to the internet.
  This is true. I still have a digital audio workstation with XP... been running for years without a hitch.
5. Re:Those wily fb links by Anonymous Coward · 2012-02-06 06:12 · Score: 0
  
  > I now officially support these fb malware apps
  Me too. I truly don't understand why people shed tears for this monstrosity. I am 100% in support of making FB as hostile an environment for users as possible. If they will not listen to reason ("you're laboring for free on behalf of this company for multiple hours a day... you even let it cause you worry, and maintain an earnest emotional attachment to the 'service'... it's unhealthy")... well, let them listen to symbolic violence.
6. Re:Those wily fb links by Tim+C · 2012-02-08 22:38 · Score: 1
  
  The sites want it as it's free advertising. I'm really not sure why the users want it though - what do I care if people know that I read a given news article? If I think it's good and worth their time, I'll post a link myself.
  
  --
  It's official. Most of you are morons.
^ right here by tkprit · 2012-02-05 17:54 · Score: 1

mod up
Not me by kheldan · 2012-02-05 18:17 · Score: 3, Informative

Apparently I picked a good month to decide I'm sick and tired of all the Failbook bullshit and delete my account.

Instructions on how to permanently delete your Facebook account

--
Are YOU using the TOOL, or is the TOOL using YOU? Think about it!
1. Re:Not me by Anonymous Coward · 2012-02-05 19:00 · Score: 1
  
  That's cute, you think that telling Facebook to delete your account removes any information they have of you.
2. Re:Not me by Anonymous Coward · 2012-02-05 19:52 · Score: 0
  
  I did the same thing yesterday. First, facebook led me to deactivate my account. I did that, but had to reactivate it to have it "ordered" for deletion. I was informed that the process to delete my account could take up to 14 days. My pc crashed not once, but twice because of all that hidden garbage. It took me at least 4 hours to clean my computer.
3. Re:Not me by Anonymous Coward · 2012-02-05 22:00 · Score: 0
  
  Sorry, but that's not why your PC crashed, and you probalby have not "cleaned" your computer. Take your machine to someone who can re-install the OS for you.
4. Re:Not me by satuon · 2012-02-05 23:19 · Score: 2
  
  Even if they actually did delete it from all their servers and backups, some of it could still have been harvested by who knows how many site grabbers and bots. And you can't delete that.
5. Re:Not me by Anonymous Coward · 2012-02-06 00:34 · Score: 1
  
  Instructions on how to permanently delete your Facebook account
  
  "Steve Krause" Seattle site:facebook.com
  http://www.google.com/#sclient=psy-ab&hl=en&source=hp&q=%22Steve+Krause%22+Seattle+site:facebook.com&oq=%22Steve+Krause%22+Seattle+site:facebook.com&aq=f&aqi=&aql=&gs_sm=e&gs_upl=30292l35604l1l41026l4l4l0l0l0l0l104l287l3.1l4l0&bav=on.2,or.r_gc.r_pw.,cf.osb&fp=fd74ce06838e713b&biw=1112&bih=799
6. Re:Not me by Anonymous Coward · 2012-02-06 04:59 · Score: 0
  
  Even if they actually did delete it from all their servers and backups, some of it could still have been harvested by who knows how many site grabbers and bots. And you can't delete that.
  Some of these "bots" would probably know a lot more about you than Facebook already. I'm amazed about the amount of privacy concerns on Slashdot about a site you voluntarily choose to upload content to share, compared to the massiv non-opt-in cross-site aggregation (including here on this site, check the HTML) of data about you Google is amassing. You think you are clever running no-script including on Slashdot? Think again, that is just one of several ways to fingerprint you.
  http://www.scientificamerican.com/article.cfm?id=how-googles-new-privacy-p
7. Re:Not me by kheldan · 2012-02-06 05:36 · Score: 1
  
  That's cute, you think I used my real name, real information, and posted personally-identifiable information about myself anywhere on Failbook, ever. At best they'd have the names of people I know, none of which would reveal my actual, legal name (and not all of them know it) unless compelled by a court order.
  
  --
  Are YOU using the TOOL, or is the TOOL using YOU? Think about it!
8. Re:Not me by kheldan · 2012-02-06 05:38 · Score: 1
  
  I used false information everywhere on Failbook, and never made posts with personally-identifiable information in it, and NEVER allowed anyone to post a photo with me in it.
  
  --
  Are YOU using the TOOL, or is the TOOL using YOU? Think about it!
9. Re:Not me by kheldan · 2012-02-06 05:39 · Score: 1
  
  No real name or personally identifiable information about me was ever used on Failbook. In fact I used completely fictitious information wherever I could, just to fuck with Failbook, and nobody I know was ever allowed by me to post photos of me.
  
  --
  Are YOU using the TOOL, or is the TOOL using YOU? Think about it!
Not a solution by happyhamster · 2012-02-05 19:59 · Score: 3, Insightful

Why should I have to set up an account at a private website just to get a job? This is ridiculous. No matter how little info one has to divulge, why? By what right? I know that the companies doing this are stupid and I would not want to work for them under normal circumstances. But the economy is in the gutter, and sometimes you have to grab the first job coming (regardless of some jokers here claiming that "there are plenty of dev jobs out there"). Hiring has become so ridiculous lately that the government needs to step in and freaking regulate the process! Just have a standardized process. All the stupid gotcha interviews, dick measuring contests, "puzzle" bs, and now having to have a freaking facebook account are utterly ridiculous. The business has clearly shown they cannot act as adults and cannot be trusted. Government should step in and set some sensible rules.
1. Re:Not a solution by satuon · 2012-02-05 23:02 · Score: 1
  
  Hiring has become so ridiculous lately that the government needs to step in and freaking regulate the process! Just have a standardized process.
  Sure. Let the government choose who they hire. So long as the governent then shells out the money to pay your wages, too.
2. Re:Not a solution by Ihmhi · 2012-02-05 23:09 · Score: 1
  
  Because in this economy, there are more than a few companies that will completely dismiss you for missing one or two trivial things. There's a hundred people lined up at the doorway to replace you.
  
  --
  Random Thoughts From A Diseased Mind (Not For Dummies)
3. Re:Not a solution by Anonymous Coward · 2012-02-05 23:27 · Score: 0
  
  The current HR labyrinth sucks, and there is certainly a case for limiting what companies can ask - in the EU, it's technically illegal to ask about certain private things, or discriminate based on race, gender or sexual preference (although that's frequently ignored, and there's not a lot you can do about it).
  Having said that, railing against things you can't change isn't a good interview technique. For your sake I hope you don't come across this way when looking for work. Being in any way unhelpful, difficult or awkward will get your CV sent to the circular file immediately. Make a blank FB account, jump through their stupid hoops and get in the door. It may be that the guys you would be working with are great, and know full well the HR process is stupid but can't do anything about it, so don't be put off by HR shenanigans.
4. Re:Not a solution by flappinbooger · 2012-02-06 01:18 · Score: 2
  
  Welcome to 2012. The people who are potentially hiring you are too lazy or stupid to do things "the old fashioned way" so they want to see if you are also stupid; stupid enough to post pictures of yourself wasted with sharpie outlines of genitalia on your face.
  
  The problem comes with the phenomenon of "tagging" where if someone ELSE who has abovementioned sharpie pictures of you can post them, tag YOU, and then they end up on YOUR page.
  
  Like I said, welcome to 2012.
  
  --
  Flappinbooger isn't my real name
5. Re:Not a solution by Anonymous Coward · 2012-02-06 02:46 · Score: 0
  
  There is the rub:
  The differences between government and business are eroding: Quite increasingly, regulations are not aimed at business, but for business.
  If you get government stepping in for "sensible rules", it will mean that there will be mandated access to FB profiles to employees by companies (for "security reasons"), and things like no poaching agreements will be law (where an employer cannot hire someone for a higher salary or benefits than the employee had at their previous job.)
  I wouldn't mind sensible rules, but not with this type of government we have now, the people pushing SOPA, PIPA, CIOCA, ACTA, and other crap, while completely ignoring the problems with a deregulated banking industry.
6. Re:Not a solution by kingturkey · 2012-02-06 05:23 · Score: 2
  
  Unless of course you set your settings to not allow tagging or just simply remove the unwanted tags. Or you could even request that the owner take down the photo if it's so embarrassing, and assuming they're not an adolescent they'd probably do it.
  The hatred for Facebook here on Slashdot is really quite absurd, and not just a little ironic as well, given that people here usually criticize others for not understanding technology.
  You can set the privacy settings how you want, sure they have defaulted to public in the past, but who here uses the default settings on anything without looking at the other options first anyway (and with government attention now they probably won't be making the same mistakes again)?
  Certainly it can be a source of problems, but that's really only if you're stupid enough to share things that shouldn't be shared with a wider audience than appropriate. Think about what you share and who you share it with (normally a mantra for the /. crowd!) and you won't have any problems.
  What you will have is a platform to connect with people you otherwise would be interested in but may not have the time/inclination to reach out to, a more efficient way of keeping up with those who you would have contacted by other means and an interesting way to pass time when you don't have anything to do/are procrastinating.
  As for the "you are the product" people, well there's not much to do about them. You are correct, but also paranoid, egocentric and absurd. That's how the internet provides you with free content: ads. Targeted ads are more valuable so Google, Facebook etc collect data about you in order to provide you with ads.
  What they don't do is sell your information, nor does anybody read it. Nobody gives a shit that you looked at looked at example.com or did a search for abc, or 'liked' a particular page. Nobody is sitting in a server room at Facebook jerking off to your "private" (read: incredibly mundane) data, you thinking that is just egotistical. The only thing that cares about it is their ad-targeting algorithms.
7. Re:Not a solution by orgelspieler · 2012-02-06 06:27 · Score: 1
  
  Unless of course you set your settings to not allow tagging or just simply remove the unwanted tags. Or you could even request that the owner take down the photo if it's so embarrassing, and assuming they're not an adolescent they'd probably do it.
  If you don't have a Facebook account, how are you supposed to disallow tagging of yourself in Facebook photos?
8. Re:Not a solution by John+Hasler · 2012-02-06 07:12 · Score: 1
  
  If you don't have a Facebook account how can you be "tagged"?
  
  --
  Warning: this article may contain humor, sarcasm, parody, and perhaps even irony. Read at your own risk.
Does it run Linux ?! by Mr+Europe · 2012-02-05 23:46 · Score: 1

NO !
1. Re:Does it run Linux ?! by azalin · 2012-02-06 01:39 · Score: 1
  
  don't you just hate being discriminated against?
60,000 people ... by Skapare · 2012-02-06 01:32 · Score: 1

... whose access to the internet and computers needs to be denied.

--
now we need to go OSS in diesel cars
Nice by Anonymous Coward · 2012-02-06 03:59 · Score: 0

I thought Facebook hired this really good hacker to help with all of this?
Facebook + Cloud Computing... scarey idea by knorthern+knight · 2012-02-06 15:40 · Score: 1

Facedrive(TM)... are you tired of paying high rates for your offsite storage and backups? Fear not, for there are versions of Facedrive(TM) specifically tailored for residential, and small/medium/large businesses. Simply click on this link http://bad.example.com/, download and launch the free app that will evaluate your hard drive, and advise you if you qualify fro FREE* service.
*Restrictions may apply.

--

I'm not repeating myself
I'm an X window user; I'm an ex-Windows user