1. Hi Guest: Welcome to TRIBE, Toronto's largest and longest running online community. If you'd like to post here, or reply to existing posts on TRIBE, you first have to register on the forum. You can register with your facebook ID or with an email address. Join us!

Facebook Clickjacking Virus

Discussion in 'Technology' started by alexd, Jun 7, 2010.

  1. alexd

    alexd Administrator Staff Member

    Posted by
    Charles Arthur Monday 7 June 2010 11.37 BST

    "Facebook's announcement of its "Like" button has been a gift - to scammers and malware authors who take advantage of its simple Javascript to write exploits.

    Such "clickjacking" exploits first began appearing last week, though with no "payload" other than to spread pages virally throughout the site. However, anti-virus companies such as Sophos are warning that it could turn into a much more aggressive technique that will end up installing malware on peoples' machines when they think that all they're doing is going to hit a "Like" button on an innocent site.

    Graham Cluley at Sophos explains that it exploits a bug (or is it a feature?) of pretty much every browser: if you overlay an invisible iframe on top of a link on a page, then you can't tell if you clicked on the link - or the iframe.

    (We wrote about iframes and the threat they posed in April 2008: What's an iframe attack and why should I care?)

    As Lockergnome points out, "clickjacking is not an operating system specific exploit, but a browser-based attack so it impacts Windows, Mac, and Linux users the same."

    In the first round of exploits, which went around last week, the messages that led to the iframe exploit included "LOL This girl gets OWNED after a POLICE OFFICER reads her STATUS MESSAGE.", and "This man takes a picture of himself EVERYDAY for 8 YEARS!!" and finally "The Prom Dress That Got This Girl Suspended From School.". (Give the scammers some credit - they know how peoples' minds work, as well as how websites work.)

    The next wave had targeted links that displayed text that says either, "Paramore n-a-k-ed photo leaked" or "Justin Biebers Phone Number Leaked!"

    The overall method was the same, though. Users following the link were taken to a page saying "Click here to continue if you are 18 years of age of above." Clicking anywhere on the site then launched an invisible iframe which contains a Facebook Like button, thus spreading the link to more and more users.

    Simon Willison, web developer extraordinaire and occasionally of this parish, notes on his blog:

    "Since Likes show up in your Facebook stream, it's an easy attack to make viral. The button is implemented on third party sites as an iframe, which would seem to me to be exploitable by design (just make the iframe transparent in the parent document and trick the user in to clicking in the right place)."

    More dangerous are his conclusions:

    "I can't think of any way they could support the embedded Like button without being vulnerable to clickjacking, since clickjacking prevention relies on not allowing your UI elements to be embedded in a hostile site, while the Like button's functionality depends on exactly that."

    It's another example of the collision between fabulously idealistic ideas of how to join all the web together, and make communication easier, and the reality - which is that there's always someone looking to make a quick (dishonest) buck. The "Like" button is a nice idea, but lacks security robustness.

    As ReadWriteWeb remarks,

    "The problem has to do with the overly simple way Facebook has implemented the "like button" feature. Non-developers can plug a URL into a wizard that generates code that can be copied and pasted anywhere on the Web. Like buttons created this way or manually, via handwritten code, will function properly even if they point to a webpage that's on a different domain from the page where the button is being hosted."

    Facebook can't do a great deal about it, because the Like button and associated code sit outside Facebook itself; and it can't detect whether someone has overlaid an iframe or similar bit of malware on the site. The only recourse open to them is to spot users and pages that seem to be passing on recognised scams and blocking exits from Facebook to them, or incoming links from them. That, however, is going to be an arms race to compare with the one against email spammers.

    "Clickjacking" was the term created by Jeremiah Grossman and Robert "RSnake" Hansen, the security researchers who brought the technique to public awareness in late 2008, notes The Register."
  2. tripleup

    tripleup TRIBE Member

    Well, I don't know why, and google is fucking useless in helping me, but facebook is forwarding to myspace on me.

    I don't even have a myspace.

  3. Spinsah

    Spinsah TRIBE Member

    This is how skynet started.
  4. stanimal

    stanimal TRIBE Member

  5. tripleup

    tripleup TRIBE Member


    Why the fuck this wasn't in my results in a google search titled "why is facebook forwarding me to myspace?" ?

    Must mean google is officially becoming useless/filled with advertised links.

Share This Page