How to Protect Yourself From The Latest Round of Nasty Facebook Worms
by Heidi White
Facebook worms have been worming their way back into the social networking giants playground, causing great concern and infecting hundreds of thousands of users in recent weeks.
This article hopes to provides some tips on how to Facebook safely.
There are basically two types of Facebook worms affecting users at this time.
Clickjacking
The first type, called Clickjacking, is a web coding technique, which runs a javascript or flash program within a users browser. The program is invisible to the user, and once activated takes over the users’ mouse, forcing it to ‘like’ a the same link that infected them, spreading it to all of the users friends. At the same time, keylogger, spyware and other malicious programs are installed onto the users computer. This “like” button worm, a clikcjacking type worm, hit Facebook over the Memorial Day weekend, and has allegedly already infected hundreds of thousands of users. At first it seemed like only a few titles were being used, such as those listed below –
‘This man takes a picture of himself EVERYDAY for 8 YEARS!!’
The Prom Dress That Got This Girl Suspended From School’
‘LOL This girl gets OWNED after a POLICE OFFICER reads her STATUS MESSAGE,’
‘This Girl Has An Interesting Way Of Eating A Banana, Check It Out!’
But now it appears the messages are updating more frequently, so it’s not possible to know which ones to avoid. Any intriguing or popular subject could be the latest title change, whether it’s about the BP Oil Spill or Justin Beiber.
If you choose to click on the “like” button from one of these infected messages – you will get redirected to a blank page with a simple message reading, ‘Click here to continue,’ or sometimes ‘Click here to confirm you are over 18.’ At this point – if you don’t completely shut down your computer – you’re probably already compromized.
If you click anything on this page, your computer will be immediately infected with the Troj/lframe-ET worm which hijacks your mouse then simultaneously:
1) causes you to send a fake “I just liked this link” message to all your friends, perpetuating the worm
2) installs any number of malicious viruses, Trojans, and keylogging programs onto your computer, allowing criminals access to your next login to your Bank of America account and worse. This current worm is spreading in a way very similar to the Fbhole virus which struck Facebook last month.
Tricked into Downloading Malicious Software
The other type of Facebook Worm currently causing concern is the type that tricks users into users into downloading malicious software, under the guise of downloading software needed to run a fake video. The Koobface Criminals have released a new variation of the worm, known as Koobface – or or the Fake Video Link Worm, which first struck Facebook last year and was supposedly put to rest last July. According to Facebook, “the program is spreading via Facebook messages that look as if they’re videos.
“These fake video links often say something like “LOL you look funny.” When the user clicks on the fake video link to see the it, she is taken to a new website and asked to download special software in order to see the video. That software is malicious,” concludes Facebook.
Facebook is downplaying the current impact of this worm and won’t state how many have been affected, suggesting “users with up-to-date anti-virus software are generally well protected from this and similar viruses.”
What can you do to protect yourself?
Other than quitting Facebook altogether, there are some things the prudent user can do to avoid being taken down by one of these Facebook worms.
Like Less
Use the Facebook ‘like’ feature less frequently, or stop using it completely for the time being. Many companies are sending messages to their employes to not use the “like” feature at all.
However, if you do want to ‘like’ something, there are ways to make sure you are not liking something potentially dangerous.
1) Avoid liking anything that ‘seems’ strange
2) Don’t assume that just because it was ‘liked’ by a trusted friend that its safe
3) Hover over a link to see where its going BEFORE you click.
4) If the hover doesn’t give you a URL, right-click while hovering to read the URL in the Windows “Properties” feature.
5) Make sure the url shows the link is staying within Facebook:
GOOD http://www.facebook.com/pages/inside-facebook
and not being Redirected to some outside page:
BAD http://www.facebook.com/l.php?u=http://www.outsidelink.com.
While redirecting to an outside link is allowed inside of Facebook and doesn’t always mean there’s a suspicious site at the other end, at times like this, it’s definately a major red-flag, and it’s how the clickjacking type web programs avoid Facebooks’ comprehensive virus filtering and security systems. To be safe, if the link is a redirect and you don’t know for sure that the web site is safe, we highly recommend you don’t go there.
Finally, the most foolproof way to avoid these worms would be to quit Facebook. Or at the very least go on-the-wagon until things get straightened out. However, unless you are ready for a 12-Step program for social networking addiction, following the best practices of keeping your anti-virus software current, and paying attention to the where the links are going BEFORE you click on them, may be only adequate way to keep you in the social networking game without giving criminals access to your computer and all it’s secrets.
Resources
Facebook Worm Refuses to Die – PC World
Like Button Worm Weaseling Through Facebook – Switched.com
Elaborate Facebook Worm Virus Spreading – Techcrunch.com
Facebook Advertising Manager
