<![CDATA[[SecurityRatty] tag: facebook]]> http://securityratty.com/tag/facebook Fri, 08 Aug 2008 09:00:00 +0000 iRatty Engine http://blogs.law.harvard.edu/tech/rss <![CDATA[Forgot your password? may be weakest link in web security]]> http://securityratty.com/article/f121122122ae1d7763240a344ce2f35b http://securityratty.com/article/f121122122ae1d7763240a344ce2f35b Wed, 27 Aug 2008 09:27:57 +0000 password web site password thompson recently link bank accounts web sites experiment friends hack Forgot your password? may be weakest link in web security <![CDATA[Facebook Malware Campaigns Rotating Tactics]]> http://securityratty.com/article/62296c3643a587ae28183112d47c0996 http://securityratty.com/article/62296c3643a587ae28183112d47c0996
Trust is vital, and coming up with ways to multiply the trust factor is crucial for a successful malware campaign spreading across social networks. Excluding the publicly available malware modules for spreading across popular social networking sites, using the presumably, already phished accounts for the foundation of the trust factor, the recent malware campaigns spreading across Facebook and Myspace are all about plain simple social engineering and a combination of tactics.

However, in between combining typosquatting and on purposely introducing longer subdomains impersonating a web application's directory structure, there are certain exceptions. Like this flash file hosted at ImageShack and spammed across Facebook profiles, which at a particular moment in the past few days used to redirect to client-side exploits served on behalf of a shady affiliate network that's apparently geolocating the campaigns based on where the visitors are coming from.

img228.imageshack .us/img228/3238/gameonit4.swf redirects to ermacysoffer .info - (216.52.184.243) and to tracking.profitsource .net (67.208.131.124) that's also responding to p223in.linktrust .com (67.208.131.124). Just for the record, we also have halifax-cnline.co.uk parked at 216.52.184.243, 69.64.145.229 and 69.64.145.229, known badware IPs related to previous fraudulent activity.

Moreover, cross-checking this campaign with another Facebook malware campaign enticing users to visit whitneyganykus.blogspot .com where a javascript obfuscation redirects to absvdfd87 .com and from there to the already known tracking.profitsource .net/redir.aspx?CID=9725&AFID=28836&DID=44292, and given that absvdfd87.com is parked at the now known 69.64.145.229, we have a decent smoking gun connecting the two campaigns.

Facebook is often advising that users stay away from weird URLs, does this mean ignoring ImageShack and Blogspot altogether? The next malware campaign could be taking advantage of DoubleClick and AdSense redirectors - for starters.
]]> Wed, 27 Aug 2008 06:04:51 +0000 malware campaign successful malware campaign facebook facebook malware campaign campaigns campaign campaigns based trust factor trust Facebook Malware Campaigns Rotating Tactics <![CDATA[Facebook Worm Still Going Strong]]> http://securityratty.com/article/3d63cb5f4654a97b393266f752d1c56a http://securityratty.com/article/3d63cb5f4654a97b393266f752d1c56a Facebook worm:

fbspam1.jpg


Click the link, and you'll see something like this:

fbspam2.jpg
Click to Enlarge

Yes, it's Ye Olde Fake Codec installer, hosted on what appears to be a hacked website. As always, pay close attention to what you're being sent from your friends. If it doesn't seem like something they'd send you, that's probably because they didn't...
]]> Mon, 25 Aug 2008 05:57:04 +0000 recent facebook worm close attention message click facebook yesterday link friend website friends Facebook Worm Still Going Strong <![CDATA[Pass It On!]]> http://securityratty.com/article/0b0eafc50e6acbced4bbec33d0e7057d http://securityratty.com/article/0b0eafc50e6acbced4bbec33d0e7057d
fbspam000.jpg


If you see this, please - ignore it and tell your friends off for sending it to others in the first place ;)
]]> Mon, 25 Aug 2008 04:33:50 +0000 useless message friends facebook day ignore Pass It On! <![CDATA[Dont click that link, think first.]]> http://securityratty.com/article/00f591f7bb48f5a7e02e423f7c206f30 http://securityratty.com/article/00f591f7bb48f5a7e02e423f7c206f30 If the links not from someone you trust, dont click it!
clipped from it.toolbox.com
New Social Malware hits the street
As social malware goes, this is a good delivery mechanism for getting people to click on links. Most of us have learned that clicking on links from people who you do not know is generally not a good idea. Spinning up the social aspect of malware delivery, using MySpace and Facebook friends should result in a better penetration of the malware because we are used to clicking on links from our friends.
  blog it
]]> Wed, 20 Aug 2008 21:15:43 +0000 malware social malware hits malware delivery social malware links click friends facebook friends social aspect Dont click that link, think first. <![CDATA[Facebook Attacked By Viral Social Networking Spam From China]]> http://securityratty.com/article/f5d91dbb95f1d40eb6b47c52ab1b76d9 http://securityratty.com/article/f5d91dbb95f1d40eb6b47c52ab1b76d9 Wed, 20 Aug 2008 06:42:33 +0000 facebook recent facebook facebook attacks websense websense security labs honeyjax system recently attack starts althoughh attacks time Facebook Attacked By Viral Social Networking Spam From China <![CDATA[Facebook faces class-action suit over Beacon]]> http://securityratty.com/article/ff6b5ab70cab7503321baa487c8b207e http://securityratty.com/article/ff6b5ab70cab7503321baa487c8b207e

]]> Tue, 12 Aug 2008 20:00:00 +0000 facebook california charges facebook class-action suit filed controversial beacon system computer fraud laws online privacy fandango overstock companies Facebook faces class-action suit over Beacon <![CDATA[Marketing Bot Allows Insertion of Custom Facebook Feed Messages]]> http://securityratty.com/article/41ee202ac244db0ab82c0ff056faa4a7 http://securityratty.com/article/41ee202ac244db0ab82c0ff056faa4a7

feed0.jpg

Click to Enlarge

Effectively, it takes bits and pieces of all the smaller feeds and rolls them into one. However, imagine instead of the above in your feed, you see something like this:

feed1.jpg

Click to Enlarge

Those are customised messages inserted into your feed - and there's a good chance everyone on your Friends list will see it on their own feed when they login to Facebook.

This would happen because someone has made a Bot for Facebook that allows you to insert your own custom message / image / clickable link into your Facebook feed. I've no idea if this is against the Facebook Terms of Service or not, but I can only imagine the chaos that would ensue if someone purchases this application then decides to use it for nefarious purposes. It's being promoted as a sales / marketing tool, but from a security standpoint it seems potentially disastrous.

If a bad actor buys their own Bot, imagine the Myspace-style spam campaigns that could take place...everything from malicious URLs to obnoxious flashing banners could be the order of the day. At the very least, one would hope the makers of this Bot have some quality control going on with regards Bot owners. More here.

/ Hat-tip to LoLo

]]> Mon, 11 Aug 2008 09:26:48 +0000 feed facebook feed facebook bot facebook news feed facebook terms bot owners friend list myspace-style spam campaigns Marketing Bot Allows Insertion of Custom Facebook Feed Messages <![CDATA[FaceBook Under Massive Phishing Attack From China]]> http://securityratty.com/article/47a657fc4d930aab9e7fff5ff8be5a2b http://securityratty.com/article/47a657fc4d930aab9e7fff5ff8be5a2b Mon, 11 Aug 2008 04:20:01 +0000 attack network effect facebook scams scammers increasingly prolification spread numerous FaceBook Under Massive Phishing Attack From China <![CDATA[Facebook stamps out malware attack]]> http://securityratty.com/article/680eda1b732d79195c6135090192afbf http://securityratty.com/article/680eda1b732d79195c6135090192afbf

]]> Fri, 08 Aug 2008 09:00:00 +0000 malware attack facebook wall feature site postings users Facebook stamps out malware attack