Wednesday, May 5, 2010

Facebook SCAMS


Blog moved. I have a new home now at www.rakeshmukundan.in Do update your bookmarks :)
As Facebook is growing in popularity,its increasingly becoming the target for various kinds of malicious attacks.I have spotted one such scam couple of days back, which will trick people into copy pasting javascript code into their browser's address bar.The code in the scam which I spotted did nothing but to invite all FB friends to view this particular scam page by sending out suggestions.Though it seems a harmless( irritating though) trick, one could some malicious intend ( say fetching the contacts personal details or session cookie) to it.
It started with the suggestion I received from a friend that I should become the fan of the page "WORST STATUS UPDATE ON THIS PLANET".Clicking this particular invitation will bring you into a page like this.

According to this page it is a two step process(!!) to reveal the WORST STATUS UPDATE EVER, first of which is to click the [LIKE] button.  

One you click the button, it will redirect you to another page, which will ask you to copy paste the given code into the browser's address bar and wait for the content to load.
While you wait, the code running in the background will send out suggestions to your FB friends, to become the fan of this page( which explains the suggestion I got).This page is no longer accessible now(thankfully), it might have taken down by the FB.

Googling parts of the javascript code showed that its a readily available piece of code to invite all your friends.Which shows this is not the only attempt made.( google revealed same tricks were used by scammers for long time, but still 2000+ people fell for this!!!).Its really disturbing to see that people blindly believe everything they see in the social networking sites( esp if it's supported/suggested by a friend). We really need to realize that not everything  we see needs to be true. So the best practice from my point of view is to think before you do something online.
Always remember, "NEVER COPY PASTE ANYTHING INTO THE ADDRESS BAR, NO MATTER WHAT IT CLAIMS TO DO"