Image via Wikipedia
It sometimes feels like the number of scams spreading across Facebook is never ending. Here is the latest one that was brought to my attention by members of Sophos’s Facebook page:
Boy reaction after his Ex girlfriend posted on his wall
[LINK]
lol What true pain both are having at this moment.
It’s another survey scam, of course, which earns commission for the folks who created the webpages and kicked off the campaign in the first place.
Image via Wikipedia
Messages are beginning to spread across Facebook, tricking users into clicking on links which claim to point to the world’s funniest condom commercial.
The messages are spreading through a clickjacking scam (sometimes known as likejacking) which means that users do not realise that they are invisibly pressing that they “Like” the video when they try to play it.
A typical message looks something like the following (the actual link can change):
The World Funniest Condom Commercial - LOL
[LINK]
haha its really so funny ~ Dont Miss it !
The scam appears to be being perpetrated by the same gang who have been successfully spreading a “Baby born amazing effect” scam over the last several days.
Clicking on the links, which so far appear to all be hosted on blogspot.com, takes users to a webpage which urges visitors to click to watch the video.
The pages have the headline “The Funniest Condom Commercial”:
Click further at your own discretion – because the clickjacking scam is about to play its part in the scheme. If you try to play the video then you will be unwittingly saying that you “Like” the link, and sharing it with your friends. In this way the link spreads virally across Facebook.
By the way, there is a condom commercial shown at the end of this whole process, but the Argentinian TV advert is available for free on YouTube meaning that there was a way of viewing it which didn’t involve helping the scammers spread their link across the Facebook social network. (Oh, and the video is not that funny).
As regular readers of Sophos’s Facebook page will know, scams like this have been seen on far too many occasions.
Recently announced new Facebook security features were supposed to provide protection against clickjacking/likejacking schemes like this – but once again have unfortunately proven to be ineffectual.
If you were running anti-clickjacking protection, such as the NoScript add-on for Firefox, then you would see a warning message about the attempted clickjacking:
Here’s how you can clean-up your Facebook page.
Find the offending message on your Facebook page, and select “Remove post and unlike”. You could also choose to mark it as spam to alert Facebook’s security team.
Unfortunately that doesn’t completely remove the connection between the mischievous link and your Facebook page. You also need to go into your profile, choose Activities and Interests and remove any pages that you don’t want to “Like”.
Of course, attacks like this would find it much harder to spread if folks were much more careful about the links they clicked on when using Facebook – and if Facebook’s in-built security was more effective at stopping clickjacking attacks.
Source : -http://nakedsecurity.sophos.com
Image via CrunchBase
Messages are spreading rapidly across Facebook, as users get tricked into clicking on links claiming to show an amazing video of a big baby being born.
The messages are spreading with the assistance of a clickjacking scam (sometimes known as likejacking) which means that users do not realise that they are invisibly pressing a “Like” button to pass the message onto their online friends.
A typical message looks as follows:
Baby Born Amazing Effect - WebCamera
[LINK]
Big Baby Born !
(Note: Graham Cluley have obscured the thumbnail used in the messages, as some may find it offensive because of its err.. anatomical nature.)
The links we have seen so far all point to pages hosted on blogspot.com, and appear to contain a video player that you are urged to click on.
The pages are headlined: “Baby Born Video – Amazing Effects”.
See the message at the bottom of the page? It reads:
If Play Button don't work please click on the Like button and Confirm, then you can watch the Video.
It’s at this point that the clickjacking scam plays its part. If you try to play the video then you will be secretly and unwittingly saying that you “Like” the link, and sharing it with your friends. In this way the link spreads virally.
It’s a shame that Facebook’s own security measures don’t warn about this clickjacking attack.
If you were running anti-clickjacking protection, such as the NoScript add-on for Firefox, then you would see a warning message about the attempted clickjacking:
Unfortunately, thousands of Facebook users appear to have fallen for the scam – and are helping the links spread rapidly across the social network.
Here’s how you can clean-up your Facebook page.
Find the offending message on your Facebook page, and select “Remove post and unlike”.
Unfortunately that doesn’t completely remove the interloping link. You also need to go into your profile, choose Activities and Interests and remove any pages that you don’t want to “Like”.
If only folks were more careful about the links they clicked on when using Facebook.
Source :- http://nakedsecurity.sophos.com
