[Hidden-tech] Beware the Facebook thingy-dingy redux

[Kevin Phillips]

Forgot the actual URL for any interested parties. It should not be clickable
but don't copy and paste it etc.
The thing to note is, the start of the url looks fine, except for the
pitjiilil.com.pl
Hover your mouce over the link and check it carefully in any email you get
like this from any social network etc.
Also I do not have this email address registered with facebook, just a free
throw away yahoo account.another warning sign.

facebook.com.pitjiilil.com.pl/
usersdirectory/LoginFacebook.php?ref=405577206960670881151052986804145717276
88618862&email=kevin at kpitconsulting.com
 

Kevin Phillips 
KPIT Consulting 
kevin at kpitconsulting.com 
Office (413) 420-0212
Cell (413) 330-7789 

www.kpitconsulting.com <http://www.kpitconsulting.com/> 

www.wmassforums.com <http://www.wmassforums.com/> 

 

________________________________

From: Michael Billingsley [mailto:michaelb at sover.net] 
Sent: Tuesday, December 29, 2009 11:05 PM
To: hidden-discuss at mm01.tnrnet.com
Subject: [Hidden-tech] Beware the Facebook thingy-dingy redux


Dear H-T'ers 

I appreciate the sincere attempts to "decode" my first post on this subject,
and the heartfelt and sage advice that A) one should never give one's
password to an unknown respondent and B) one should avoid visiting websites
mascarading as one's favourite social networking provider, asking you to
re-set or provide personal information.

All well and good.

My notice was that the original "faked" Facebook member security-upgrade
announcement was sourced by as server in Romania... pre-loaded with
PC-jacking software... may have escaped attention, but I will reiterate.
Now that same "crew" of criminals has re-sent a second round of bogus and
equally high-quality "upgrading your Facebook security" notices on Christmas
Day - this one sourced (ultimately) from a server in Chile.  Again the
package was very high-class... and any visitor to that website just to see
what it might be about immediately will be sniffed (to determine your OS)
and then become loaded with a software packet.  No asking for passwords.  No
security questions.  Just simply visiting the webpage will lead to your
computer being compromised.

This "slaving" of multiple PC's and Mac's could be part of some largish
project... as yet to be reveiled... and has been going on for about four
weeks now (since American Thanksgiving). It seems aimed at users of Facebook
because such North and South American and EU users are, in general, owners
of fast OS PC's with a lot of RAM... over-cranked for video editing, etc.
In other words, fast and powerful machines in a home environment with poor
oversight and lousy firewalls - usually left on all night with an open
highspeed Internet connection.  Lots and lots of them.   The last time a
project of great scale was attempted like this, the Russian government
paralysed the Internet connectivity of the Georgian government through
Denial of Service attacks (DoS)... via secretly enslaved home computers
throughout the EU, lined up at the required moment and doing the will of a
hired remote console operator in Latvia or wherever.

So I would add to the above injunctions - C) don't even "click" on the link
shown in the Facebook email... don't visit the page (details below) 

Don't explore the website.  Don't "open your door"... these guys are openly
bragging that they can go through any firewall and take remote control of
most PC's.  The worst aspect of this is that as recently as a few days ago,
the exploitation of legitimate website servers (through a process called
"SQL-injection") has made it possible for hackers to get those websites to
"hand over" to them (in real-time) passport information, user data and other
incoming/ongoing data transactions without anyone being aware for hours.   

Facebook itself has also suffered big recent attacks (called
"click-jacking") as a result of this.  But perhaps even more ominous is that
Amazon and a number of other big vendors suffered a temporary DoS attack
over the weekend.  That recent attack (a simultaneous arrival of thousands
of multiple queries) must have been launched from thousands of
remote-controlled private PC's whose owners were none the wiser... perhaps
picked up through this Facebook scam.

FBI cybercrimes are hoping that it is not a "test run" for something much
bigger.  I've personally been concerned that the criminals behind this are
being paid by a heavy-handed national entity like Iran, poised to shut down
the international servers used by their opposition to get news and email out
of Iran... through a huge Denial of Service attack using
Facebook-compromised personal PC's in the Americas and Europe.

Facebook is now admitting that it's been seeing some kind of significant
trouble.   The full story is below my signature (please do not Reply or Copy
this email without first selecting the message-only portions).

Good luck to all.  Stay clean.  Use Microsoft Process Monitor or Mac's
Activity Monitor to watch your computer activity is you suspect hanky-panky,
and disconnect from the Internet or fully shut down when you stop
computing... unless you have a scheduled cloud backup coming up.  (And don't
forget to shut off your wireless, not just your Ethernet.)  It might be a
while before the bug scan software catches up.

Michael Cerulli Billingsley
Straight Arrow Recordings
802-254-3975/380-6408
The Cotton Mill, Brattleboro, Vermont
Location Recording - CD Mastering - Audio Solutions/FX


Facebook Hit By Clickjacking Attack

Social network targeted by emerging brand of attack that's hard to kill
Dec 23, 2009 | 04:51 PM
By Kelly Jackson Higgins
DarkReading

Facebook is cleaning up after a clickjacking attack that infiltrated the
social networking site this week -- and security experts say this won't be
the last such attack.


Clickjacking, in which an attacker slips a malicious link or malware onto a
legitimate Web page that appears to contain normal content, is an emerging
threat experts have been warning about. The attack on Facebook was in the
form of a comment on a user's account with a photo that lured the victim to
click on it. The embedded link took the victim to a Web page that presented
like a CAPTCHA or Turing test, and asked the user to click on a blue "Share"
button on the Facebook page.


Once clicked, the victim is redirected to a YouTube video, and then the same
post shows up on the victim's account and thus tries to infect his or her
friends. Security experts say the attack appeared to be more of a prank or
trial balloon, and it affects only Firefox and Chrome browsers, according to
security expert Krzysztof Kotowicz, who blogged about the attack
<http://blog.kotowicz.net/2009/12/new-facebook-clickjagging-attack-in.html>
this week.


Facebook has now blocked the URL to the malicious site, fb.59.to. "This
problem isn't specific to Facebook, but we're always working to improve our
systems and are building additional protections against this type of
behavior. We've blocked the URL associated with this site, and we're
cleaning up the relatively few cases where it was posted -- something email
providers, for example, can't do," a Facebook spokesperson says.


Robert "RSnake" Hansen, CEO of SecTheory -- who, along with Jeremiah
Grossman, CTO of WhiteHat Security, warned the industry about the threat of
clickjacking more than a year ago -- says Facebook and most other sites
don't employ much anti-clickjacking protection.


"This could be the beginning of a new wave of anti-Facebook clickjacking
worms," Hansen says. "This same concept has already hit Twitter several
times. It generally takes a few attacks for companies like this to wake up
and realize the problem doesn't magically go away just by blocking one
link."


But Facebook's spokesperson says the social networking site is also "working
against these attacks on a number of fronts," including deframing scripts
and X-Frame options. Hansen recommends employing both of these methods to
combat clickjacking.


The clickjacking concept is really nothing new, but Hansen and Grossman last
year discovered a brand of clickjacking
<http://www.darkreading.com/security/management/showArticle.jhtml?articleID=
211201251>  that spans browser families and doesn't even require a user to
click on anything. Just loading a compromised page sets off the attack, and
clicking on that page will likely make things worse for the victim, they
say. Clickjacking is both a Web and a browser problem, but the fixes likely
need to come from the browser vendors. But a fix goes to the way browsers
work, which means there's no simple fix.


"Clickjacking is such an easy attack and one that is completely unaddressed.
We'll see much more of this, especially across the social networks,"
WhiteHat's Grossman says.


Kotowicz blogged that the clickjacking attack contains malicious iFrames,
and that the reason the attack didn't affect Internet Explorer and Opera is
due to an incorrect HTML in one of the pages.


Meanwhile, Facebook is reminding users to be wary of any posts, messages, or
links on Facebook or anywhere else that appear suspicious, the Facebook
spokesperson says.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.hidden-tech.net/pipermail/hidden-discuss/attachments/20091230/2440b988/attachment.html