Feeds

Facebook users warned over stalk-my-profile scam

Crap snoop app escapes whack-a-mole policy

Securing Web Applications Made Simple and Scalable

A bogus application that lures Facebook users by falsely offering to show who has been viewing their profile has been exposed as a scam.

Rik Ferguson, a senior security consultant at Trend Micro, warns he has already identified 25 different copies of the same rogue app but using different monikers such as peeppeep-pro, profile-check-online and stalk-my-profile.

All of the rogue apps are spread by updates seeking to lure the friends of previous victims to give the stalkerware a try. Some even offer a photo montage of a victim's contacts in a bid to add more authenticity. However, none of the apps actually do anything except profit their creators via ad affiliate revenues and deceptive tactics.

"The app itself is designed to look convincing enough, but none of the many 'Continue' buttons it offers will activate some under-the-counter profile checking functionality - they will just push you into another Facebook app earning the scammer advertising revenue in the process," Ferguson explains in a blog post containing screenshots illustrating the scam, which resurfaced over the weekend.

"There is no officially sanctioned Facebook functionality that will allow you to view who has been checking your profile."

Facebook recently removed the ability for applications to send notifications directly. The unknown creators of stalk-my-profile have built in functionality designed to get around that limitation while still attracting the attention of would-be marks.

Security staff at Facebook acted promptly on Sunday to remove the rogue apps. That's all well and good, but Ferguson argues that only the introduction of an app-vetting scheme - something he first suggested over a year ago - stands any chance of bringing under control the growing problem of misuse of the social network by rogue application developers.

A similar scam again involving a supposed answer to the question "Who is checking your profile?" was squashed by Facebook in late February, Websense reported at the time. The reappearance of much the same scam just two weeks later underlines Ferguson's contention that simply playing whack-a-mole with rogue apps is a waste of resources that unnecessarily endangers Facebook users.

Another run of rogue apps, detected by Ferguson at the end of February, attempted to fool victims into clicking the spam notifications it sent out, earning dodgy developers affiliate-based ad revenues in the process. The app adopted the name “Like” and borrowed the icon from the official Facebook “Likes” function, but was in reality nothing more than cheap crud whose only function was to direct users towards a website offering an application called Zwinky, as Ferguson explains here. ®

Mobile application security vulnerability report

More from The Register

next story
LibreSSL RNG bug fix: What's all the forking fuss about, ask devs
Blow to bit-spitter 'tis but a flesh wound, claim team
HIDDEN packet sniffer spy tech in MILLIONS of iPhones, iPads – expert
Don't panic though – Apple's backdoor is not wide open to all, guru tells us
Manic malware Mayhem spreads through Linux, FreeBSD web servers
And how Google could cripple infection rate in a second
NUDE SNAPS AGENCY: NSA bods love 'showing off your saucy selfies'
Swapping other people's sexts is a fringe benefit, says Snowden
Own a Cisco modem or wireless gateway? It might be owned by someone else, too
Remote code exec in HTTP server hands kit to bad guys
British data cops: We need greater powers and more money
You want data butt kicking, we need bigger boots - ICO
Crooks fling banking Trojan at Japanese smut site fans
Wait - they're doing online banking with an unpatched Windows PC?
NIST told to grow a pair and kick NSA to the curb
Lrn2crypto, oversight panel tells US govt's algorithm bods
prev story

Whitepapers

Reducing security risks from open source software
Follow a few strategies and your organization can gain the full benefits of open source and the cloud without compromising the security of your applications.
Consolidation: The Foundation for IT Business Transformation
In this whitepaper learn how effective consolidation of IT and business resources can enable multiple, meaningful business benefits.
Application security programs and practises
Follow a few strategies and your organization can gain the full benefits of open source and the cloud without compromising the security of your applications.
Boost IT visibility and business value
How building a great service catalog relieves pressure points and demonstrates the value of IT service management.
Consolidation: the foundation for IT and business transformation
In this whitepaper learn how effective consolidation of IT and business resources can enable multiple, meaningful business benefits.