[Hidden-tech] Beware the Facebook thingy-dingy redux

[Michael Billingsley]

Dear H-T'ers

I appreciate the sincere attempts to "decode" my first post on this  
subject, and the heartfelt and sage advice that A) one should never  
give one's password to an unknown respondent and B) one should avoid  
visiting websites mascarading as one's favourite social networking  
provider, asking you to re-set or provide personal information.

All well and good.

My notice was that the original "faked" Facebook member security- 
upgrade announcement was sourced by as server in Romania... pre- 
loaded with PC-jacking software... may have escaped attention, but I  
will reiterate.   Now that same "crew" of criminals has re-sent a  
second round of bogus and equally high-quality "upgrading your  
Facebook security" notices on Christmas Day - this one sourced  
(ultimately) from a server in Chile.  Again the package was very high- 
class... and any visitor to that website just to see what it might be  
about immediately will be sniffed (to determine your OS) and then  
become loaded with a software packet.  No asking for passwords.  No  
security questions.  Just simply visiting the webpage will lead to  
your computer being compromised.

This "slaving" of multiple PC's and Mac's could be part of some  
largish project... as yet to be reveiled... and has been going on for  
about four weeks now (since American Thanksgiving). It seems aimed at  
users of Facebook because such North and South American and EU users  
are, in general, owners of fast OS PC's with a lot of RAM... over- 
cranked for video editing, etc.  In other words, fast and powerful  
machines in a home environment with poor oversight and lousy  
firewalls - usually left on all night with an open highspeed Internet  
connection.  Lots and lots of them.   The last time a project of  
great scale was attempted like this, the Russian government paralysed  
the Internet connectivity of the Georgian government through Denial  
of Service attacks (DoS)... via secretly enslaved home computers  
throughout the EU, lined up at the required moment and doing the will  
of a hired remote console operator in Latvia or wherever.

So I would add to the above injunctions - C) don't even "click" on  
the link shown in the Facebook email... don't visit the page (details  
below)

Don't explore the website.  Don't "open your door"... these guys are  
openly bragging that they can go through any firewall and take remote  
control of most PC's.  The worst aspect of this is that as recently  
as a few days ago, the exploitation of legitimate website servers  
(through a process called "SQL-injection") has made it possible for  
hackers to get those websites to "hand over" to them (in real-time)  
passport information, user data and other incoming/ongoing data  
transactions without anyone being aware for hours.

Facebook itself has also suffered big recent attacks (called "click- 
jacking") as a result of this.  But perhaps even more ominous is that  
Amazon and a number of other big vendors suffered a temporary DoS  
attack over the weekend.  That recent attack (a simultaneous arrival  
of thousands of multiple queries) must have been launched from  
thousands of remote-controlled private PC's whose owners were none  
the wiser... perhaps picked up through this Facebook scam.

FBI cybercrimes are hoping that it is not a "test run" for something  
much bigger.  I've personally been concerned that the criminals  
behind this are being paid by a heavy-handed national entity like  
Iran, poised to shut down the international servers used by their  
opposition to get news and email out of Iran... through a huge Denial  
of Service attack using Facebook-compromised personal PC's in the  
Americas and Europe.

Facebook is now admitting that it's been seeing some kind of  
significant trouble.   The full story is below my signature (please  
do not Reply or Copy this email without first selecting the message- 
only portions).

Good luck to all.  Stay clean.  Use Microsoft Process Monitor or  
Mac's Activity Monitor to watch your computer activity is you suspect  
hanky-panky, and disconnect from the Internet or fully shut down when  
you stop computing... unless you have a scheduled cloud backup coming  
up.  (And don't forget to shut off your wireless, not just your  
Ethernet.)  It might be a while before the bug scan software catches up.

Michael Cerulli Billingsley
Straight Arrow Recordings
802-254-3975/380-6408
The Cotton Mill, Brattleboro, Vermont
Location Recording - CD Mastering - Audio Solutions/FX

Facebook Hit By Clickjacking Attack

Social network targeted by emerging brand of attack that's hard to kill
Dec 23, 2009 | 04:51 PM
By Kelly Jackson Higgins
DarkReading

Facebook is cleaning up after a clickjacking attack that infiltrated  
the social networking site this week -- and security experts say this  
won't be the last such attack.

Clickjacking, in which an attacker slips a malicious link or malware  
onto a legitimate Web page that appears to contain normal content, is  
an emerging threat experts have been warning about. The attack on  
Facebook was in the form of a comment on a user's account with a  
photo that lured the victim to click on it. The embedded link took  
the victim to a Web page that presented like a CAPTCHA or Turing  
test, and asked the user to click on a blue "Share" button on the  
Facebook page.

Once clicked, the victim is redirected to a YouTube video, and then  
the same post shows up on the victim's account and thus tries to  
infect his or her friends. Security experts say the attack appeared  
to be more of a prank or trial balloon, and it affects only Firefox  
and Chrome browsers, according to security expert Krzysztof Kotowicz,  
who blogged about the attack this week.

Facebook has now blocked the URL to the malicious site, fb.59.to.  
"This problem isn't specific to Facebook, but we're always working to  
improve our systems and are building additional protections against  
this type of behavior. We've blocked the URL associated with this  
site, and we're cleaning up the relatively few cases where it was  
posted -- something email providers, for example, can't do," a  
Facebook spokesperson says.

Robert "RSnake" Hansen, CEO of SecTheory -- who, along with Jeremiah  
Grossman, CTO of WhiteHat Security, warned the industry about the  
threat of clickjacking more than a year ago -- says Facebook and most  
other sites don't employ much anti-clickjacking protection.

"This could be the beginning of a new wave of anti-Facebook  
clickjacking worms," Hansen says. "This same concept has already hit  
Twitter several times. It generally takes a few attacks for companies  
like this to wake up and realize the problem doesn't magically go  
away just by blocking one link."

But Facebook's spokesperson says the social networking site is also  
"working against these attacks on a number of fronts," including  
deframing scripts and X-Frame options. Hansen recommends employing  
both of these methods to combat clickjacking.

The clickjacking concept is really nothing new, but Hansen and  
Grossman last year discovered a brand of clickjacking that spans  
browser families and doesn't even require a user to click on  
anything. Just loading a compromised page sets off the attack, and  
clicking on that page will likely make things worse for the victim,  
they say. Clickjacking is both a Web and a browser problem, but the  
fixes likely need to come from the browser vendors. But a fix goes to  
the way browsers work, which means there's no simple fix.

"Clickjacking is such an easy attack and one that is completely  
unaddressed. We'll see much more of this, especially across the  
social networks," WhiteHat's Grossman says.

Kotowicz blogged that the clickjacking attack contains malicious  
iFrames, and that the reason the attack didn't affect Internet  
Explorer and Opera is due to an incorrect HTML in one of the pages.

Meanwhile, Facebook is reminding users to be wary of any posts,  
messages, or links on Facebook or anywhere else that appear  
suspicious, the Facebook spokesperson says.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.hidden-tech.net/pipermail/hidden-discuss/attachments/20091229/ed926622/attachment.html