Thanks to a tip-off from colleague Gadi Evron, I’ve just spent some time looking into the latest Facebook worm after he alerted Facebook about it.

Like so many past worms, this one uses a suggestive come-on to lure the unsuspecting into clicking a link, and after some behind-the-scenes shenanigans, it posts a link to the same lure page on the victim’s Facebook wall, if the click-happy victim is currently logged into Facebook.

I’m not much of a Facebooker (in fact, only using it for investigating things like this!) but I’ve heard reports that this is working, as more and more folk’s walls start to look something like this:

For those unfamiliar with Facebook (is there anyone other than me in that set?) the thumbnail of the worm’s infective page is a link to the page. The worm’s objective, of course, is that others viewing the victim’s wall will click the link, and as they are logged into Facebook, the worm will propagate its link to that victim’s wall, and so on…

How does this all work? Rather simple really and something Facebook needs to fix.

This worm uses what is technically known as a CSRF (Cross-site Request Forgery, also called XSRF) attack. A sequence of iframes on the exploit page call a sequence of other pages and scripts, eventually resulting in a form submission to Facebook “as if” the victim had submitted a URL for a wall post and clicked on the “Share” button to confirm the post.

So, at least until Facebook fixes its side of the problem here, be especially careful in which buttons you decide to click, baby!

Share | |