The Giant Security Hole That Facebook Doesn’t Care About

You probably assume hackers are using all sorts of devious viruses, obscure scripts, "exploits" (whatever that means, right?) and other complex means to break into accounts. But often the means of entry are stupid simple. Facebook has a huge one—and doesn't care about fixing it

There's a basic premise here that isn't a Facebook problem, but really an internet problem: it's super easy to reset someone's password. The web is an ornate, lumbering thing built on tiny little stilt legs, its foundation unfit for what came after it. It's complex stuff standing on simpler stuff. New on old. And often the old can't cut it: just ask Giz alum Mat Honan, whose online life was savaged because of the stupid-simple processes standing between assholes and us online. You don't need to be a hacker—you can just talk your way in:

Step one: Say you've forgotten your password.
Step two: Say you've forgotten your email address.
Step three: Use a security question or customer service rep to change over to a new email address—one you control.
Step four: Send a new password of your choosing to that new email address.
Step five: Log in.

This is the same lazy, methodical trick that hit Honan, breached @BurgerKing, and this past weekend, tried to crack my Facebook account. Again, and again, and again, because Facebook makes it so easy.

The crux of the problem is impossibly stupid: Facebook won't let you change your security question. The street you grew up on, the name of your first cat, your college mascot—these bits of dumb personal trivia are all it takes to claim complete control of someone else's Facebook account. You probably forgot the day you even entered yours. Luckily, it's so obvious, you'll never forget it. That's the simultaneous beauty and stupidity of the security question: eternally memorable.

But hey, what if someone happens to guess this extremely guessable piece of information about you, based on readily Google and Facebook-available details? What if they use the answer to this question to repeatedly attempt to break into your account—perhaps successfully? Shouldn't you be able to change that question to something that isn't already known by someone with clearly nefarious intentions?

You'd think so, and you'd be wrong. There's no way to manually switch your security question to something new if you're worried someone might have the answer. Or just to switch it up for the sake of switching it up, as we do with passwords. Facebook simply won't let you.

Fake Facebook alert leads to Blackhole, malware

Due to the huge popularity of Facebook and its one billion active users, bogus emails impersonating the social network are constantly hitting users' inboxes.

The latest of these is a notification alert about "activity you may have missed on Facebook":



Clicking on any of the offered buttons or the "unsubscribe" link ultimately lands users on a page hosting the Blackhole exploit kit serving an exploit for Adobe Reader and Acrobat.

Victims who use any of the vulnerable versions of these two software and no AV solution are automatically saddled with an information-stealing Trojan.

The Trojan variant in question is now detected by 28 of the 43 AV products used by Virus Total, but at the beginning of the spam campaign even those who had AV software installed were not safe, as the malware was detected by only three of them, Webroot warns.

Users are advised never to follow links offered in unsolicited emails, no matter how legitimate they look. Check your Facebook account for "activity you have missed" if you must, but do it by logging in through the legitimate login page.

Bogus Apple invoice leads to Blackhole, banking malware

If you receive an invoice seemingly coming from Apple that apparently shows that your credit card has been billed for $699,99 (or a similar preposterously huge amount of money) because you bought postcard, don't click on any of the embedded links no matter how curious or alarmed you are.

The bogus invoice looks good enough to fool many (click on the screenshot to enlarge it):



"The link 'View/Download' ends in download.jpg.exe, while the 'Cancel' and 'Not your order' URLs end in check.php," shares Graham Cluley. "The smart social engineering bit is that, whether you are simply curious what this is about or furious about this unauthorized charge, you are still likely to click one of the links."

A click on the former link will automatically download the malware, while a click on the latter ones will take the victims to a bogus IRS page warning them that they are using an unsupported browser.

But this is simply a smokescreen designed to puzzle the user while the Blackhole exploit kit works furiously in the background, trying to exploit a host of Oracle Java, Adobe Flash Player and Adobe Reader vulnerabilities.

If it succeeds, the victims' computer is infected with a variant of the Zeus / Zbot banking Trojan. If not, they are offered a download of the latest version of their browser. The offered file is named update.exe and is also a Zeus Trojan variant.

Digitally signed ransomware lurking in the wild

Trend Micro researchers have spotted two ransomware variants bearing the same (probably stolen) digital signature in order to fool users into running the files.

Other than that, the malware acts like any other ransomware: it blocks the victims' computer and shows messages that seem to come either from the FBI or the UK’s Police Central e-crime Unit:



"Users may encounter these files by visiting malicious sites or sites exploiting a Java vulnerability," say the researchers.

And if the bogus law enforcement messages are anything to go by, it seems that those same malware peddlers have managed to hack the DNS records of Go Daddy hosted websites so that they can redirect victims to malicious sites hosting the Cool exploit kit.

Sophos' researchers speculate that the DNS records hijacking was due to stolen or weak passwords.

"Go Daddy customers who wish to check they have not been affected by these attacks should check their DNS configuration according to the Go Daddy support page," they advise.

Facebook Black Is Scamming You

As more and more people join social networks like Facebook and Twitter, it only gets easier for scam artists to pick off a few non-discerning users. The latest scam that's making its way across Facebook offers to change your user interface to a cool, new color if you're sick of the boring old Facebook blue.

Users are now seeing images advertising the new "Facebook Black" in their news feeds. The image asks users to click a link shared above, which will then lead them to an official-looking app permissions screen. Of course, there's no such thing as "Facebook Black" and clicking on the link will only open you up to a possible security breach.

Sophos' Naked Security blog reports that the ruse is the work of survey scammers, who prey on unsuspecting users who will complete surveys in order to receive the promised product. These surveys earn affiliate cash for the scammers.



"Are you sick fo that boring old blue theme? Well now you have the power to change your facebook color to anything your heart desires," reads the page. Sophos claims that some versions of the dubious link attempt to fool users by displaying a limited time offer and prompting them to generate a code to access the new feature.

Although they may look legit to the untrained eye, some of the scam landing pages can be easily identified because they have failed to wipe the text from previous clickjacking scams, such as the Remove Facebook Timeline scams popular earlier this year.



As always, the advice here is to investigate any "new feature" or "offer" that seems too good to be true or out of the ordinary. And if you happen to get caught up in a scam, make sure you remove any corresponding likes and app permissions from your Facebook account.

Malware targeting Skype missed a trick

Last week reports came out stating that the Dorkbot worm is now targeting Skype users. The worm fools users into downloading the malware, whose payload locks down machines. Once infected, users' contact lists are pinged with the message "LOL is this your new profile pic?" and a .zip file.

When the .zip file is clicked it opens a backdoor and installs the worm. The machine is then enlisted into a botnet and users are asked to make a $200 payment within 24 to 48 hours in order to receive their files back.

This ransomware aspect of the worm is a new element compared to the previous strains that affected Facebook and Twitter.

Dominique Karg, Chief Hacking officer from AlienVault, comments on why he thinks the Dorkbot will not be as effective as it could have been:

“There are three things about this worm that surprises me:

Firstly, the phrase "LOL is this your new profile pic?" makes it look like this is targeted at a younger segment of the population. Therefore really narrowing down on the victims.

If the target is the younger generation then $200 seems like a lot of money for that "target" audience. Why not make it $50? I think a lot more people who have contacts who would send them a .zip file with a "LOL is this your new profile pic?" message would pay $50 or $100 rather than $200. And I'm thinking about the US here. $200 in some other countries is a small fortune...

Why the 24/48 hour timeframe? Are the authors trying to urge people into paying before the malware gets deleted? The harm is done anyway at this point, deleting the malware won't get the files back, as far as I know, so why the urge?

This malware doesn't exploit any system vulnerability; it exploits trust so with the right message they could have got a lot more people to be fooled into executing the program (worm). We always warn people to disregard attachments from unknown people. However, in this case this file is being sent from your trusted ‘buddies’.

It surprises me that the people who have written this malware have not made the message change depending on the target. If the target's name is 2 words, then they could have put something more serious, like "please don't share this but I wanted you to have it", while to a 1 word destination (much more likely to be a nickname or a "buddy") they could have sent the above message.

Finally, in Skype you can also see the local time for your contacts, which should give you a rough idea of where they are located at "wealth" wise, therefore enabling them to adjust the ransom accordingly. The writers of this malware are definitely missing a trick."