Rogue Facebook app creates malign buzz
Sting in the tail
A Facebook application using misleading messages spread quickly over the weekend. The application itself did no harm beyond making a mess but may be part of an indirect attempt to attract surfers towards sites promoting scareware packages.
The application, Error Check System, posed as notification of errors in a Facebook user's profile. Attempting to view these supposed errors allowed the application to activate. This, in turn, allowed the application to access to the affected user's friends, who were then spammed with notifications, further spreading the social networking chain-letter.
The Unofficial Facebook blog reports that the application created a message blizzard over the weekend.
The Facebook application performs no malign activity on the social network site beyond spreading around and annoying people. However searches for the phrase "Error Check System" via Google and other search engines return numerous results pointing to sites punting rogue antivirus (AKA scareware) packages. The promotion of fake antimalware sites may therefore be the ultimate aim of the miscreants behind the attack, anti-virus firm F-Secure speculates. ®
So, Facebook is becoming a test platform for script kiddies ? This is going to be fun to watch.
Installing without warning page?
That definitely shouldn't be possible.
Neither should this: http://news.bbc.co.uk/1/hi/technology/7376738.stm
Investigative journalists for the BBC managed to create and publish an application which gathers data not only of those that opt-in, but also their friends.
.. here was that this application managed to circumvent the 'Allow this application access..?' page which is normally displayed. I knew from the bad grammar that it was fishy, but as the warning page usually includes a link to the facebook application page I thought I'd sniff out a few more details.
No warning; as soon as I clicked a notification link it added itself to my applications.
Should this be possible? I was under the impression it wasn't.