Members
  • Total Members: 14176
  • Latest: toxxxa
Stats
  • Total Posts: 42869
  • Total Topics: 16078
  • Online Today: 3672
  • Online Ever: 51419
  • (01. January 2010., 10:27:49)









Author Topic: 'Clickjacking' worm hits hundreds of thousands Facebook users (LOL This girl...)  (Read 2582 times)

0 Members and 1 Guest are viewing this topic.

Samker

  • SCF Administrator
  • *****
  • Posts: 7528
  • KARMA: 322
  • Gender: Male
  • Whatever doesn't kill us makes us stronger.
    • SCforum.info - Samker's Computer Forum


A vulnerability on Facebook forced hundreds of thousands of users to endorse a series of webpages over the holiday weekend, making the social networking site the latest venue for an attack known as clickjacking.

The exploit works by presenting people with friend profiles that recommend — or "Like," in Facebook parlance — links with titles including "LOL This girl gets OWNED after a POLICE OFFICER reads her STATUS MESSAGE." Those who click on the link see a page that's blank except for the words "Click here to continue." Clicking anywhere on the page automatically forces the person to add the link to his list of Likes.

Clickjacking is a term that was coined in late 2008 by web application security researchers Jeremiah Grossman and Robert "RSnake" Hansen. It describes attacks that allow malicious website publishers to control the links visitors click on. Virtually every browser is vulnerable, although many browsers come with safeguards that can make exploitation harder.

The Facebook worm that hit over the weekend superimposes an invisible iframe over the entire page that links back to the victim's Facebook page. As a result, as long as the person is logged in, his profile automatically recommends the link to new friends as soon as the page is clicked on.

Twitter was attacked by a series of clickjacking exploits last year that forced users to publish tweets against their will. The exploits stopped after company engineers finally tightened down their site. Facebook engineers will undoubtedly follow suit, if they haven't already.

Sophos has more here: http://www.sophos.com/blogs/gc/g/2010/05/31/viral-clickjacking-like-worm-hits-facebook-users/

(El Reg)

Samker's Computer Forum - SCforum.info


 

With Quick-Reply you can write a post when viewing a topic without loading a new page. You can still use bulletin board code and smileys as you would in a normal post.

Name: Email:
Verification:
Type the letters shown in the picture
Listen to the letters / Request another image
Type the letters shown in the picture:
Second Anti-Bot trap, type or simply copy-paste below (only the red letters):www.scforum.info:

Enter your email address to receive daily email with 'SCforum.info - Samker's Computer Forum' newest content:

Terms of Use | Privacy Policy | Advertising