PandaLabs, the anti-malware laboratory of Panda Security, has reported a new proliferation of scams that highjack the Facebook “Like” option. The attacks use bogus messages that look like they’re from friends, with topics related to the popular game Farmville, the film Sex and the City 2 or simply the keyword “sex.” Unwary Facebook users who click on the links in these messages are taken to a Web page containing photos and videos of the relevant topic.
But, unbeknownst to those users, simply visiting that page causes a message to be displayed on their Facebook profile indicating that they “like” it, with a text that is not controlled by them.
This technique, known as “clickjacking,” uses a modified (and malicious) URL with embedded code to carry out the attack and trick users into “liking” a page without necessarily realizing that they are recommending it to all of their Facebook friends.
“This distribution technique reminds us of computer worms,” says Luis Corrons, Technical Director of PandaLabs. “Although at this time there doesn’t seem to be any malware behind it.”
According to Corrons, the real business stems from the pay-per-click system, which counts clicks and generates revenue for affiliates. “Cyber-criminals can make money just by tricking you into visiting a Web page with ads,” says Corrons. “Or worse still, they can spread malware and infect you. This possibility has not yet been exploited, but it would be relatively easy and effective to do it.”
PandaLabs advises users to be extremely wary of messages with striking subjects received from Facebook’s internal messaging system, and to take all necessary precautions when clicking the “Like” button on external Web pages. One good practice for users is to hover over the “Like” button on a non-Facebook page and look at the url that’s displayed. If it seems strange, it’s best not to click. Also, PandaLabs recommends that users refrain from entering any banking or credit card information in applications that try to sell them any kind of test.