Feeds

'Clickjacking' worm hits hundreds of thousands on Facebook

'This girl gets OWNED.' And you can too

Intelligent flash storage arrays

A vulnerability on Facebook forced hundreds of thousands of users to endorse a series of webpages over the holiday weekend, making the social networking site the latest venue for an attack known as clickjacking.

The exploit works by presenting people with friend profiles that recommend — or "Like," in Facebook parlance — links with titles including "LOL This girl gets OWNED after a POLICE OFFICER reads her STATUS MESSAGE." Those who click on the link see a page that's blank except for the words "Click here to continue." Clicking anywhere on the page automatically forces the person to add the link to his list of Likes.

Clickjacking is a term that was coined in late 2008 by web application security researchers Jeremiah Grossman and Robert "RSnake" Hansen. It describes attacks that allow malicious website publishers to control the links visitors click on. Virtually every browser is vulnerable, although many browsers come with safeguards that can make exploitation harder.

The Facebook worm that hit over the weekend superimposes an invisible iframe over the entire page that links back to the victim's Facebook page. As a result, as long as the person is logged in, his profile automatically recommends the link to new friends as soon as the page is clicked on.

Twitter was attacked by a series of clickjacking exploits last year that forced users to publish tweets against their will. The exploits stopped after company engineers finally tightened down their site. Facebook engineers will undoubtedly follow suit, if they haven't already. But this isn't the first time Facebook has been hit by clickjacking.

Sophos has more here. ®

This post was updated to correct a statement about Adobe Flash. The animation software is just one of many many web-based technologies that can be abused in clickjacking attacks.

Top 5 reasons to deploy VMware with Tegile

Whitepapers

Choosing cloud Backup services
Demystify how you can address your data protection needs in your small- to medium-sized business and select the best online backup service to meet your needs.
Forging a new future with identity relationship management
Learn about ForgeRock's next generation IRM platform and how it is designed to empower CEOS's and enterprises to engage with consumers.
Security for virtualized datacentres
Legacy security solutions are inefficient due to the architectural differences between physical and virtual environments.
Reg Reader Research: SaaS based Email and Office Productivity Tools
Read this Reg reader report which provides advice and guidance for SMBs towards the use of SaaS based email and Office productivity tools.
Storage capacity and performance optimization at Mizuno USA
Mizuno USA turn to Tegile storage technology to solve both their SAN and backup issues.