It’s not the Paramore leaked photo. And it’s not Justin Bieber’s phone number. But it’s a clickjacking scam that’s spreading rapidly across a social-networking site that’s already plagued with privacy issues. Hundreds of thousands of Facebook users are falling into a scammer trap to post messages to their personal pages indicating they like a malicious link.
p
Subject lines on the tricky messages include LOL This girl gets OWNED after a POLICE OFFICER reads her STATUS MESSAGE, This man takes a picture of himself EVERYDAY for 8 YEARS!!, The Prom Dress That Got This Girl Suspended From School, and This Girl Has An Interesting Way Of Eating A Banana, Check It Out!
p
Facebook users who click on the link are escorted to what looks like a nearly blank page with the message: Click here to continue. What Facebook users don’t know is that there is hidden IFrame code in the page. So when they click anywhere on the infected page, the IFrame posts a message to their Facebook page.
p
subhead
The Invisible Like Button
/subhead
p
According to Graham Cluley, a senior security consultant at Sophos, the worms all exploit Facebook’s new Like social plug-in that the social network rolled out recently. The Like feature expands upon a user’s existing ability to say they Like any Facebook page to say they also Like external third-party web pages.
p
Clicking at any point of the page publishes the same message — via an invisible IFrame — to the visiting users’ own Facebook page without their permission, Cluley said. Effectively, there is a huge invisible button underneath your mouse which means wherever you click on the page, you are clicking that you ‘Like the page.’ And so it spreads further and further.
p
How dangerous is it? Cluley noted that it spreads very quickly as friends share the viral links with each other….