New X-Rated Facebook Worm

There is a new Facebook worm which will direct you to a link containing pornography. The following are the details of the worm:

The hook to the new Facebook worm appears in a friend’s profile as the racy image at left.

Click the image, and you are brought to a Web page with the same image.

Analysis by famous malware analyst Nick Fitzgerald calls this a CSRF
(Cross-Site Request Forgery) attack, a cousin to cross-site scripting:

A sequence of iframes on the exploit page call a sequence of other pages and scripts, eventually resulting in a form submission to Facebook “as if” the victim had submitted a URL for a wall post and clicked on the “Share” button to confirm the post.

Afterward, you are redirected to a porn site.

AVG’s Roger Thompson writes about the same issue to note that its LinkScanner protection blocks this attack and that another hook to the same malicious site is operating as “the popular farmville app” (I’ve never heard of it). All of the authors say that this is something that needs to be fixed by Facebook, and they expect it to be fixed very soon.

Source:
PC Magazine Security Watch

Tagged as: Facebook, Facebook Worm