FACEBOOK MALWARE SCAM TAKES HOLD

Moderated & Moved from News to forum by Myschoolcomm staff

A"worrying number" of
Facebook users are
sharing a link to a
malware-laden fake
CNN news page
reporting the U.S. has
attacked Iran and
Saudi Arabia, security
firm Sophos.
If users who follow the
link then click to play
what purports to be
video coverage of the
attack, they are
prompted to update
their Adobe Flash
player with a pop-up
window that looks
very much like the real
thing. Those who
accept the prompt
unwittingly install
malware on their
computers.
Within three hours of
the scam's appearance,
more than 60,000
users had followed a
link to the spoofed
CNN page, according to
Sophos Senior Security
Advisor Chester
Wisniewski. Facebook
removed that link, but
others are still being
shared.
"The bad guys are
rotating through scam
pages trying to stay
ahead of Facebook,"
Wisniewski said.
In a statement,
Facebook said it was
"in the process of
cleaning up this spam
now, and remediating
any affected users."
Wisniewski said there
are a number of ways
that status updates
could appear without
users' knowledge.
Their Facebook
accounts could have
been hacked, allowing
a third party to update
their status. It is also
possible for scammers
to exploit weaknesses
in the social
networking platform
itself or in Web
browsers to post a
status update using
JavaScript.
A representative status
update shown in a
screenshot on the
Sophos blog reads,
"U.S. Attacks Iran and
Saudia Arabia. F**k :-
( [LINK] The Begin of
World War 3?"
Users who accepted
the Flash player
update prompt
installed a fake
antivirus tool on their
computers. That tool
would then alert them
that their computer is
infected with malware
that can be eliminated
for a fee. Such scams
are one of the most
lucrative, Wisniewski
said, noting the irony
that they net far more
money than the
legitimate security
products Sophos and
other security
companies peddle.
In addition to
exercising a healthy
dose of skepticism that
the U.S. would attack
its ally Saudi Arabia,
Facebook users can
avoid the scam and
others like it by
updating Flash only
from Adobe's own
website rather than
from pop-ups.