Privacy has been one of the major concerns of Facebook users today, especially as the social network continues to increasingly grow to become a massive directory of personal information. Users are becoming very concerned as to who can access the information they post, fearful that these may be viewed and used in a malicious way. Given this, stalkers—people who aim to invade other people’s privacy—are considerably becoming Facebook users’ worst nightmare.
Facebook scams play on people’s fear of being stalked. This is not surprising, we have recently seen newly created domains that offer help to users in order to track down who most view their profiles, as well as how many times these were viewed. The domains contain strings like “profile view” and “creepers” in their URLs, suggesting their alleged purpose.
The pages list down certain instructions the user must follow to use the “stalker tool.” The instructions include copying a certain script and pasting it into one’s browser address bar.
The technique is very similar to a scheme we saw last year, which used the lure “10 lies girls ALWAYS tell guys! Funny!” In this case, the lure may be different but the effect is pretty much the same. Once the user copies the script into his address bar and executes it, his Facebook account is accessed by the script then used to spam messages that promote the stalker tool.
The said messages are randomly generated and may be posted either as a private message or as a wall post.
 |
We tested if the so-called stalker tool works in all browsers and found that it does as long as JavaScript is enabled. The said script is now detected by Trend Micro as HTML_FBSPAM.ASM while access to the related domains is now blocked.
netizens left a footprint.