7 ms·

Ingenious Hack by Facebook Spammers: Smoking Hot Bartenders

176 points by jgv 16y ago

duck 16y ago
And the slippery slope begins...
po 16y ago
We've seen this kind of scammy stuff before, where people overlay a transparent div on top of another div. This is the first time that I've seen them attach to the cursor and follow it around. Other than keeping your browser logged out of facebook at all times, what's the protection against this?
- NathanKP 16y ago
  The only possible protection that I can think of would be for Facebook to require confirmation when someone likes a page. Essentially it would redirect the user to Facebook where they would see a page that says "Are you sure you want to like ______?" Then, after they agreed, it would redirect them back to the original site. However, this would be highly undesirable for people who use the Facebook like button, because it could siphon away potentially valuable visitors who appreciated the site enough to like it. Another option might be for Facebook to ban likes on a domain basis. If a domain is using spammy techniques like this then ban it from being liked by anyone. Of course that means more overhead and moderation. I don't think there is a good solution to this, only work arounds.
  - greenlblue 16y ago
    Here's one: stop using facebook.
  - jogle 16y ago
    Facebook already does ban on a domain basis, but of course that's not a fix at all. These things are "viral" by the nature of the Like button since it posts on the user's wall automatically, so it's very easy for the "spammer" to make a new domain and get going again very quickly. The easiest fix to the spreading of this issue is FB not broadcasting every single time you like something... but they're not gonna do that, we already know. So, the spam will continue.
  - potatolicious 16y ago
    What about forcing embedding sites to load a FB JS file, such that a standard Facebook confirm dialog pops up? This way the user doesn't navigate away from the site but some level of confirmation is made.
    - pak 16y ago
      If the dialog pops up and is not within an <iframe>, then the page can simulate a click on the confirm button. Even if the JS library uses an <iframe>, it can always be reverse engineered to not use one, and the user won't know because iframes are not obvious to the user. The way above, where a new page is opened with the Facebook URL clearly displayed in the browser address bar, is the only way for Facebook to ensure that likes are legit short of putting CAPTCHA's next to the like buttons. Oh, and users never check the address bar anyway.
      - lftl 16y ago
        I don't see how reverse engineering to not use an iframe would help. Presumably Facebook would have some type of check on the iframed like page that ensures that the request is actually coming from FB. How would an attacker recreate an iframed page they don't have access to?
        chopsueyar 16y ago
        Subdomains and DNS mods with a proxy?
    - points 16y ago
      It'd be trivial to modify js behavior before the FB JS file loads. For example... window.confirm = function(m) { return true; }
  - khafra 16y ago
    Perhaps a batch confirmation once a week on facebook; "likes" don't become active until you look through a list of likes from the last seven days and ok them? Most of that sort of thing isn't very time-sensitive.
- amalcon 16y ago
  With imagemaps, there's no longer a legitimate reason to ever need to "click" on something that's transparent. Therefore, the browser should not allow objects that are not visible to receive "click" events.
  - neilk 16y ago
    I actually use this trick for good, not evil. It's a way of styling certain unstyleable elements in old browsers. But you have a point -- it's useless in modern browsers. That said, what is the standard? Is 5% enough?
    - po 16y ago
      Maybe we need fractional clicks. If you click on a 0% opaque button then you don't get a click. If it's 1% opaque, then you get 1% of a click event. :-) Actaully... I started writing that as a joke but now that I think about it, if the browser embedded the opacity value of the clicked element in the GET or POST header, the webserver receiving the click could set the standard themselves. Alternately, since facebook has lots of resources, facebook could make a request to the referring site themselves, render the page and determine if there are any shenanigans going on with z-ordering or opacity automatically. You could look at all of the css applied to all of the element affecting those pixels. No... this is all crazy. Just pick a value like 30% and disallow clicks on anything less.
      - pak 16y ago
        What about visibility: hidden? What about background: transparent? What about background: url(transparent.png)? What about background: data:encoded-transparent-image... Even browser-side "visibility" calculations can become an AI-level problem quickly.
        dLuna 16y ago
        There is an easy solution to the AI calculation though. Anything not proven visible counts as invisible. Done!
- carussell 16y ago
  This somewhat demonstrates why GET isn't supposed to be used to change server state. Somewhat.
  - duskwuff 16y ago
    Not particularly. If Facebook used POST internally to implement the Like button, the result would be the exact same.
    - carussell 16y ago
      Note the double use of "somewhat". They'd need to put the form to be POSTed on a page of their control that the browser would GET after clinking a simple link in the form a a "like" button.
- statictype 16y ago
  what's the protection against this? Well, you could open these links in an Incognito window which doesn't have access to your Facebook cookies. Obviously this solution doesn't scale to normal users.
patio11 16y ago
tangentially related: I do not know if people have figured this out yet: liking something gives them permission to write to your status feed. I think after that gets widely understood people will be less promiscuous with the thumbs up, because it will be associated with being spammed to heck. I have done this to myself, incidentally, because I did not believe the doc tha said it was possible. If you include Open Graph tags on your Web page, your page becomes equivalent to a Facebook page. This means when a user clicks a Like button on your page, a connection is made between your page and the user. Your page will appear in the "Likes and Interests" section of the user's profile, and you have the ability to publish updates to the user. Your page will show up in same places that Facebook pages show up around the site (e.g. search), and you can target ads to people who like your content.
- DanielBMarkham 16y ago
  Worse yet, if your friends like something or run an app, they can get to your personal information because your friend has endorsed something. This means either cutting your friends out of your private data, selecting your friends based on their computer savvy, or being as vulnerable as the most insecure of them. I say again: Facebook is the devil. It's a brilliant platform that should continue to grow for years. It uses your own friends to make you do things you would not normally do (like join). As a platform it has no other goal than total domination of the net.
  - reiddraper 16y ago
    Can you link to the Facebook developer docs for this? I've been playing with their api and haven't seen anything like this, just getting name and uid of friends. Not saying your wrong, just curious.
  - kingsley_20 16y ago
    Simply liking something does not let a developer get access to your friend list. You will have to give the app at least basic permission (aka "run/install", which will share your friend names and uids) or extended permissions will get you friend's feed, statuses,birthdays, contact details etc. But extended perms have really poor conversions, so most spammers don't go that far. Only a matter of time before that gets clickjacked though.
ubernostrum 16y ago
A few of these have been floating around for at least the past couple months. One of my friends clicked through and ended up "liking" some picture of a stupid tattoo, and earned an educational lecture from me as his reward.
novum 16y ago
This has been a known vulnerability since at least July 13. Interactive demos: http://erickerr.com/like-clickjacking http://erickerr.com/like-clickjacking This would appear to be (among?) the first malicious use of the like-jacking vulnerability.
- jacquesm 16y ago
  If that matches your definition of malicious you've led a protected life style!
charlesju 16y ago
The question I have is how do these guys plan to make money off this scam? There doesn't seem to be any ads on this page or any affiliate pages.
- charlesju 16y ago
  lol no one knows? that's fishy
ax0n 16y ago
It's clickjacking. That was 2008. This is clickjacking with a like button. I wrote about it in early June ( http://www.h-i-r.net/2010/06/viral-like-jacking-on-facebook.html http://www.h-i-r.net/2010/06/viral-like-jacking-on-facebook.... ) and it was already somewhat old-hat by then. In fact, I think I covered the same technical details this person did. It's not really ingenious. It's just scammy behavior and yet another fine reason to run NoScript.
- points 16y ago
  NoScript isn't a good solution and certainly not a scalable one - most people don't want to browse without js. It'd be better for browser makers to simply detect clickjacking and block it. If an element isn't visible to the user (either partially visible or behind other elements), that's probably a good sign it shouldn't be able to receive user actions such as clicks. Especially if it's an iframe. I hope firefox+chrome do some work on this soon.
  - jrockway 16y ago
    NoScript is a specific Firefox extension, not general advice to turn off Javascript. NoScript lets you whitelist trusted Javascript, so when you visit that spam site, its Javascript doesn't run. Meanwhile, when you visit omg-animated-lolcats-yay.com, you notice that the lolcats aren't omg-animated, so you click one button to whitelist the Javascript, and then you get your omg-animated-lolcats forever. Yay!
    - points 16y ago
      >> "so you click one button to whitelist the Javascript" It's amazing how quickly 'click one button to be able to view this website' would irritate the hell out of anyone. It's certainly an option for geeks or security freakouts, but not really an option for normal people. Also how would a 'normal' person decide if a website is 'safe' to enable js or not? If you're the kind of person fooled into clicking for 'hot bartenders' and filling out a survey to get access, you're probably not able to decide if you should enable js or not. The solution isn't to shift responsibility to users, it's to fix the browser flaws that allow clickjacking to happen. The example given here should be a textbook easy to fix bug in browsers. It's a browser issue which should be high priority. An iframe which isn't visible to the user, should not be able to receive input from the user.
tlrobinson 16y ago
Clickjacking (the name of this exploit) is one reason many sites have frame-busting JavaScript. Of course the whole point of the Facebook "Like" button is to be embedded on other websites, so frame busting is out of the question. I'm not sure if there's a quick fix for this. Browsers need to disallow clicking of transparent iframes.
doron 16y ago
I actually clicked on the page, following my girlfriend Facebook. But I was protected due to the ever useful Adblock extension. Probably the best plugin out there, the easiest method to fire and forget about annoying web elements.
- shadowflit 16y ago
  Agree there! When the like button started spawning everywhere, I consulted the internal annoy-o-meter and determined that the best solution would be to block the button.
barrkel 16y ago
It's because of crap like this that I only browse sites like Facebook from a secondary browser, Chrome in my case. On Firefox, I'm not even logged in to Facebook, to minimize the amount they can learn about me with their Like stuff.
- tuacker 16y ago
  Likewise, I only check Facbeook on my phone. There are some exceptions but I always use Incognito mode for those.
abalashov 16y ago
I got p0wned earlier today by the same sort of chat-bot/spam exploit I've been seeing from some of my friends. As a Chrome user on Linux, and a pretty much lifelong user of Linux on the desktop, I am rather unaccustomed to being the victim of such exploits, so I didn't immediately know what to do. This one appears to be purely browser/JS-based and/or perhaps exploits some weakness in the Facebook API. It started when a (presumably "infected") friend of mine posted on my wall. It looked to be just text, but presumably contained a trigger for this exploit. Anyway, within seconds, somehow, unbeknownst to me, I was apparently initiating chat conversations with every friend who was online "asking," "Do you have a second?" When they would reply "yes?", I would blast them with some bullshit quiz/test site link, which I can only assume is a phishing farm. Anyway, this continued relentlessly so long as I was logged into the site (and possibly when I wasn't, never definitively established that) until it occurred to me to change my Facebook account password, after which it - knock on wood - seems to have stopped. Does anyone have any idea how this exploit works? It caught me rather off-guard because I expected that sort of thing to be the work of viruses and/or malware on Windows. I would guess that my password was somehow phished out, after which some foreign agent logged into the Facebook messenger as me externally (quite possible to do, numerous IM clients now support the Facebook messenger protocol) and went nuts, but I can't be sure.
- lftl 16y ago
  It sounds like a script injection, but that would be a pretty big flaw in FB and 1) Would spread pretty fast 2) Would be picked up by FB pretty quickly as well.
jacquesm 16y ago
Ever since a facebook widget showed the names of a bunch of people I know on the right-hand side of an unrelated website I've stopped going there. I logged out of facebook and I haven't logged in since then. I'd much prefer it if they stayed within their 'boundaries of expected online territory', and to see them popping up on sites that I normally visit but that I do not associate with facebook at all was enough to push me over the edge. I'm sure that plenty of people couldn't care less, but I think it's a creepy thing.
barryaustin 16y ago
I avoid this by keeping my core apps in Chrome/Chromium and by browsing everything else with Firefox+NoScript+ABP.

176 points by jgv 16y ago

duck 16y ago

And the slippery slope begins...

po 16y ago

We've seen this kind of scammy stuff before, where people overlay a transparent div on top of another div. This is the first time that I've seen them attach to the cursor and follow it around. Other than keeping your browser logged out of facebook at all times, what's the protection against this?

NathanKP 16y ago
The only possible protection that I can think of would be for Facebook to require confirmation when someone likes a page. Essentially it would redirect the user to Facebook where they would see a page that says "Are you sure you want to like ______?" Then, after they agreed, it would redirect them back to the original site. However, this would be highly undesirable for people who use the Facebook like button, because it could siphon away potentially valuable visitors who appreciated the site enough to like it. Another option might be for Facebook to ban likes on a domain basis. If a domain is using spammy techniques like this then ban it from being liked by anyone. Of course that means more overhead and moderation. I don't think there is a good solution to this, only work arounds.
- greenlblue 16y ago
  Here's one: stop using facebook.
- jogle 16y ago
  Facebook already does ban on a domain basis, but of course that's not a fix at all. These things are "viral" by the nature of the Like button since it posts on the user's wall automatically, so it's very easy for the "spammer" to make a new domain and get going again very quickly. The easiest fix to the spreading of this issue is FB not broadcasting every single time you like something... but they're not gonna do that, we already know. So, the spam will continue.
- potatolicious 16y ago
  What about forcing embedding sites to load a FB JS file, such that a standard Facebook confirm dialog pops up? This way the user doesn't navigate away from the site but some level of confirmation is made.
  - pak 16y ago
    If the dialog pops up and is not within an <iframe>, then the page can simulate a click on the confirm button. Even if the JS library uses an <iframe>, it can always be reverse engineered to not use one, and the user won't know because iframes are not obvious to the user. The way above, where a new page is opened with the Facebook URL clearly displayed in the browser address bar, is the only way for Facebook to ensure that likes are legit short of putting CAPTCHA's next to the like buttons. Oh, and users never check the address bar anyway.
    - lftl 16y ago
      I don't see how reverse engineering to not use an iframe would help. Presumably Facebook would have some type of check on the iframed like page that ensures that the request is actually coming from FB. How would an attacker recreate an iframed page they don't have access to?
      - chopsueyar 16y ago
        Subdomains and DNS mods with a proxy?
  - points 16y ago
    It'd be trivial to modify js behavior before the FB JS file loads. For example... window.confirm = function(m) { return true; }
- khafra 16y ago
  Perhaps a batch confirmation once a week on facebook; "likes" don't become active until you look through a list of likes from the last seven days and ok them? Most of that sort of thing isn't very time-sensitive.
amalcon 16y ago
With imagemaps, there's no longer a legitimate reason to ever need to "click" on something that's transparent. Therefore, the browser should not allow objects that are not visible to receive "click" events.
- neilk 16y ago
  I actually use this trick for good, not evil. It's a way of styling certain unstyleable elements in old browsers. But you have a point -- it's useless in modern browsers. That said, what is the standard? Is 5% enough?
  - po 16y ago
    Maybe we need fractional clicks. If you click on a 0% opaque button then you don't get a click. If it's 1% opaque, then you get 1% of a click event. :-) Actaully... I started writing that as a joke but now that I think about it, if the browser embedded the opacity value of the clicked element in the GET or POST header, the webserver receiving the click could set the standard themselves. Alternately, since facebook has lots of resources, facebook could make a request to the referring site themselves, render the page and determine if there are any shenanigans going on with z-ordering or opacity automatically. You could look at all of the css applied to all of the element affecting those pixels. No... this is all crazy. Just pick a value like 30% and disallow clicks on anything less.
    - pak 16y ago
      What about visibility: hidden? What about background: transparent? What about background: url(transparent.png)? What about background: data:encoded-transparent-image... Even browser-side "visibility" calculations can become an AI-level problem quickly.
      - dLuna 16y ago
        There is an easy solution to the AI calculation though. Anything not proven visible counts as invisible. Done!
carussell 16y ago
This somewhat demonstrates why GET isn't supposed to be used to change server state. Somewhat.
- duskwuff 16y ago
  Not particularly. If Facebook used POST internally to implement the Like button, the result would be the exact same.
  - carussell 16y ago
    Note the double use of "somewhat". They'd need to put the form to be POSTed on a page of their control that the browser would GET after clinking a simple link in the form a a "like" button.
statictype 16y ago
what's the protection against this? Well, you could open these links in an Incognito window which doesn't have access to your Facebook cookies. Obviously this solution doesn't scale to normal users.

patio11 16y ago

tangentially related: I do not know if people have figured this out yet: liking something gives them permission to write to your status feed. I think after that gets widely understood people will be less promiscuous with the thumbs up, because it will be associated with being spammed to heck. I have done this to myself, incidentally, because I did not believe the doc tha said it was possible. If you include Open Graph tags on your Web page, your page becomes equivalent to a Facebook page. This means when a user clicks a Like button on your page, a connection is made between your page and the user. Your page will appear in the "Likes and Interests" section of the user's profile, and you have the ability to publish updates to the user. Your page will show up in same places that Facebook pages show up around the site (e.g. search), and you can target ads to people who like your content.

DanielBMarkham 16y ago
Worse yet, if your friends like something or run an app, they can get to your personal information because your friend has endorsed something. This means either cutting your friends out of your private data, selecting your friends based on their computer savvy, or being as vulnerable as the most insecure of them. I say again: Facebook is the devil. It's a brilliant platform that should continue to grow for years. It uses your own friends to make you do things you would not normally do (like join). As a platform it has no other goal than total domination of the net.
- reiddraper 16y ago
  Can you link to the Facebook developer docs for this? I've been playing with their api and haven't seen anything like this, just getting name and uid of friends. Not saying your wrong, just curious.
- kingsley_20 16y ago
  Simply liking something does not let a developer get access to your friend list. You will have to give the app at least basic permission (aka "run/install", which will share your friend names and uids) or extended permissions will get you friend's feed, statuses,birthdays, contact details etc. But extended perms have really poor conversions, so most spammers don't go that far. Only a matter of time before that gets clickjacked though.

ubernostrum 16y ago

A few of these have been floating around for at least the past couple months. One of my friends clicked through and ended up "liking" some picture of a stupid tattoo, and earned an educational lecture from me as his reward.

novum 16y ago

This has been a known vulnerability since at least July 13. Interactive demos: http://erickerr.com/like-clickjacking http://erickerr.com/like-clickjacking This would appear to be (among?) the first malicious use of the like-jacking vulnerability.

jacquesm 16y ago
If that matches your definition of malicious you've led a protected life style!

charlesju 16y ago

The question I have is how do these guys plan to make money off this scam? There doesn't seem to be any ads on this page or any affiliate pages.

charlesju 16y ago
lol no one knows? that's fishy

ax0n 16y ago

It's clickjacking. That was 2008. This is clickjacking with a like button. I wrote about it in early June ( http://www.h-i-r.net/2010/06/viral-like-jacking-on-facebook.html http://www.h-i-r.net/2010/06/viral-like-jacking-on-facebook.... ) and it was already somewhat old-hat by then. In fact, I think I covered the same technical details this person did. It's not really ingenious. It's just scammy behavior and yet another fine reason to run NoScript.

points 16y ago
NoScript isn't a good solution and certainly not a scalable one - most people don't want to browse without js. It'd be better for browser makers to simply detect clickjacking and block it. If an element isn't visible to the user (either partially visible or behind other elements), that's probably a good sign it shouldn't be able to receive user actions such as clicks. Especially if it's an iframe. I hope firefox+chrome do some work on this soon.
- jrockway 16y ago
  NoScript is a specific Firefox extension, not general advice to turn off Javascript. NoScript lets you whitelist trusted Javascript, so when you visit that spam site, its Javascript doesn't run. Meanwhile, when you visit omg-animated-lolcats-yay.com, you notice that the lolcats aren't omg-animated, so you click one button to whitelist the Javascript, and then you get your omg-animated-lolcats forever. Yay!
  - points 16y ago
    >> "so you click one button to whitelist the Javascript" It's amazing how quickly 'click one button to be able to view this website' would irritate the hell out of anyone. It's certainly an option for geeks or security freakouts, but not really an option for normal people. Also how would a 'normal' person decide if a website is 'safe' to enable js or not? If you're the kind of person fooled into clicking for 'hot bartenders' and filling out a survey to get access, you're probably not able to decide if you should enable js or not. The solution isn't to shift responsibility to users, it's to fix the browser flaws that allow clickjacking to happen. The example given here should be a textbook easy to fix bug in browsers. It's a browser issue which should be high priority. An iframe which isn't visible to the user, should not be able to receive input from the user.

tlrobinson 16y ago

Clickjacking (the name of this exploit) is one reason many sites have frame-busting JavaScript. Of course the whole point of the Facebook "Like" button is to be embedded on other websites, so frame busting is out of the question. I'm not sure if there's a quick fix for this. Browsers need to disallow clicking of transparent iframes.

doron 16y ago

I actually clicked on the page, following my girlfriend Facebook. But I was protected due to the ever useful Adblock extension. Probably the best plugin out there, the easiest method to fire and forget about annoying web elements.

shadowflit 16y ago
Agree there! When the like button started spawning everywhere, I consulted the internal annoy-o-meter and determined that the best solution would be to block the button.

barrkel 16y ago

It's because of crap like this that I only browse sites like Facebook from a secondary browser, Chrome in my case. On Firefox, I'm not even logged in to Facebook, to minimize the amount they can learn about me with their Like stuff.

tuacker 16y ago
Likewise, I only check Facbeook on my phone. There are some exceptions but I always use Incognito mode for those.

abalashov 16y ago

I got p0wned earlier today by the same sort of chat-bot/spam exploit I've been seeing from some of my friends. As a Chrome user on Linux, and a pretty much lifelong user of Linux on the desktop, I am rather unaccustomed to being the victim of such exploits, so I didn't immediately know what to do. This one appears to be purely browser/JS-based and/or perhaps exploits some weakness in the Facebook API. It started when a (presumably "infected") friend of mine posted on my wall. It looked to be just text, but presumably contained a trigger for this exploit. Anyway, within seconds, somehow, unbeknownst to me, I was apparently initiating chat conversations with every friend who was online "asking," "Do you have a second?" When they would reply "yes?", I would blast them with some bullshit quiz/test site link, which I can only assume is a phishing farm. Anyway, this continued relentlessly so long as I was logged into the site (and possibly when I wasn't, never definitively established that) until it occurred to me to change my Facebook account password, after which it - knock on wood - seems to have stopped. Does anyone have any idea how this exploit works? It caught me rather off-guard because I expected that sort of thing to be the work of viruses and/or malware on Windows. I would guess that my password was somehow phished out, after which some foreign agent logged into the Facebook messenger as me externally (quite possible to do, numerous IM clients now support the Facebook messenger protocol) and went nuts, but I can't be sure.

lftl 16y ago
It sounds like a script injection, but that would be a pretty big flaw in FB and 1) Would spread pretty fast 2) Would be picked up by FB pretty quickly as well.

jacquesm 16y ago

Ever since a facebook widget showed the names of a bunch of people I know on the right-hand side of an unrelated website I've stopped going there. I logged out of facebook and I haven't logged in since then. I'd much prefer it if they stayed within their 'boundaries of expected online territory', and to see them popping up on sites that I normally visit but that I do not associate with facebook at all was enough to push me over the edge. I'm sure that plenty of people couldn't care less, but I think it's a creepy thing.

barryaustin 16y ago

I avoid this by keeping my core apps in Chrome/Chromium and by browsing everything else with Firefox+NoScript+ABP.