Dear H-T'ers I appreciate the sincere attempts to "decode" my first post on this subject, and the heartfelt and sage advice that A) one should never give one's password to an unknown respondent and B) one should avoid visiting websites mascarading as one's favourite social networking provider, asking you to re-set or provide personal information. All well and good. My notice was that the original "faked" Facebook member security- upgrade announcement was sourced by as server in Romania... pre- loaded with PC-jacking software... may have escaped attention, but I will reiterate. Now that same "crew" of criminals has re-sent a second round of bogus and equally high-quality "upgrading your Facebook security" notices on Christmas Day - this one sourced (ultimately) from a server in Chile. Again the package was very high- class... and any visitor to that website just to see what it might be about immediately will be sniffed (to determine your OS) and then become loaded with a software packet. No asking for passwords. No security questions. Just simply visiting the webpage will lead to your computer being compromised. This "slaving" of multiple PC's and Mac's could be part of some largish project... as yet to be reveiled... and has been going on for about four weeks now (since American Thanksgiving). It seems aimed at users of Facebook because such North and South American and EU users are, in general, owners of fast OS PC's with a lot of RAM... over- cranked for video editing, etc. In other words, fast and powerful machines in a home environment with poor oversight and lousy firewalls - usually left on all night with an open highspeed Internet connection. Lots and lots of them. The last time a project of great scale was attempted like this, the Russian government paralysed the Internet connectivity of the Georgian government through Denial of Service attacks (DoS)... via secretly enslaved home computers throughout the EU, lined up at the required moment and doing the will of a hired remote console operator in Latvia or wherever. So I would add to the above injunctions - C) don't even "click" on the link shown in the Facebook email... don't visit the page (details below) Don't explore the website. Don't "open your door"... these guys are openly bragging that they can go through any firewall and take remote control of most PC's. The worst aspect of this is that as recently as a few days ago, the exploitation of legitimate website servers (through a process called "SQL-injection") has made it possible for hackers to get those websites to "hand over" to them (in real-time) passport information, user data and other incoming/ongoing data transactions without anyone being aware for hours. Facebook itself has also suffered big recent attacks (called "click- jacking") as a result of this. But perhaps even more ominous is that Amazon and a number of other big vendors suffered a temporary DoS attack over the weekend. That recent attack (a simultaneous arrival of thousands of multiple queries) must have been launched from thousands of remote-controlled private PC's whose owners were none the wiser... perhaps picked up through this Facebook scam. FBI cybercrimes are hoping that it is not a "test run" for something much bigger. I've personally been concerned that the criminals behind this are being paid by a heavy-handed national entity like Iran, poised to shut down the international servers used by their opposition to get news and email out of Iran... through a huge Denial of Service attack using Facebook-compromised personal PC's in the Americas and Europe. Facebook is now admitting that it's been seeing some kind of significant trouble. The full story is below my signature (please do not Reply or Copy this email without first selecting the message- only portions). Good luck to all. Stay clean. Use Microsoft Process Monitor or Mac's Activity Monitor to watch your computer activity is you suspect hanky-panky, and disconnect from the Internet or fully shut down when you stop computing... unless you have a scheduled cloud backup coming up. (And don't forget to shut off your wireless, not just your Ethernet.) It might be a while before the bug scan software catches up. Michael Cerulli Billingsley Straight Arrow Recordings 802-254-3975/380-6408 The Cotton Mill, Brattleboro, Vermont Location Recording - CD Mastering - Audio Solutions/FX Facebook Hit By Clickjacking Attack Social network targeted by emerging brand of attack that's hard to kill Dec 23, 2009 | 04:51 PM By Kelly Jackson Higgins DarkReading Facebook is cleaning up after a clickjacking attack that infiltrated the social networking site this week -- and security experts say this won't be the last such attack. Clickjacking, in which an attacker slips a malicious link or malware onto a legitimate Web page that appears to contain normal content, is an emerging threat experts have been warning about. The attack on Facebook was in the form of a comment on a user's account with a photo that lured the victim to click on it. The embedded link took the victim to a Web page that presented like a CAPTCHA or Turing test, and asked the user to click on a blue "Share" button on the Facebook page. Once clicked, the victim is redirected to a YouTube video, and then the same post shows up on the victim's account and thus tries to infect his or her friends. Security experts say the attack appeared to be more of a prank or trial balloon, and it affects only Firefox and Chrome browsers, according to security expert Krzysztof Kotowicz, who blogged about the attack this week. Facebook has now blocked the URL to the malicious site, fb.59.to. "This problem isn't specific to Facebook, but we're always working to improve our systems and are building additional protections against this type of behavior. We've blocked the URL associated with this site, and we're cleaning up the relatively few cases where it was posted -- something email providers, for example, can't do," a Facebook spokesperson says. Robert "RSnake" Hansen, CEO of SecTheory -- who, along with Jeremiah Grossman, CTO of WhiteHat Security, warned the industry about the threat of clickjacking more than a year ago -- says Facebook and most other sites don't employ much anti-clickjacking protection. "This could be the beginning of a new wave of anti-Facebook clickjacking worms," Hansen says. "This same concept has already hit Twitter several times. It generally takes a few attacks for companies like this to wake up and realize the problem doesn't magically go away just by blocking one link." But Facebook's spokesperson says the social networking site is also "working against these attacks on a number of fronts," including deframing scripts and X-Frame options. Hansen recommends employing both of these methods to combat clickjacking. The clickjacking concept is really nothing new, but Hansen and Grossman last year discovered a brand of clickjacking that spans browser families and doesn't even require a user to click on anything. Just loading a compromised page sets off the attack, and clicking on that page will likely make things worse for the victim, they say. Clickjacking is both a Web and a browser problem, but the fixes likely need to come from the browser vendors. But a fix goes to the way browsers work, which means there's no simple fix. "Clickjacking is such an easy attack and one that is completely unaddressed. We'll see much more of this, especially across the social networks," WhiteHat's Grossman says. Kotowicz blogged that the clickjacking attack contains malicious iFrames, and that the reason the attack didn't affect Internet Explorer and Opera is due to an incorrect HTML in one of the pages. Meanwhile, Facebook is reminding users to be wary of any posts, messages, or links on Facebook or anywhere else that appear suspicious, the Facebook spokesperson says. -------------- next part -------------- An HTML attachment was scrubbed... URL: http://lists.hidden-tech.net/pipermail/hidden-discuss/attachments/20091229/ed926622/attachment.html