How a Typical Facebook Scam Works?

If you have been on Facebook for a decent amount of time, you may have definitely come across videos posts on your news wall that have an enticing title and an innocent thumbnail but upon clicking, the link takes you a scam website.
How do such scams happen on Facebook and why do they go viral so quickly? If a trusted friend is sharing such links with your, does that mean her Facebook account is hacked or does she have a virus on her computer that is quietly posting these dangerous links on her behalf? Not really.
Matt Jones, who works with the Data & Security team at Facebook, has recorded an informative screencast video where he walks you through the various type of scams that happen on Facebook.com and why do they happen. Most scams require Facebook users to copy-paste some JavaScript code into the browser's address bar and as soon as they do that, the rogue post is automatically published to the walls of all their Facebook friends.

Facebook Scams and XSS

Interestingly, according to Matt, Google Chrome and Safari are the only browsers that are susceptible to this kind of cross-site scripting (XSS) vulnerability while IE and Firefox are relatively safe. And since the malicious JavaScript code is often hidden inside Flash videos, Facebook isn’t able to detect it. Maybe the solution is that they allow video embeds from trusted websites.

Countermeasures:

Tips to avoid facebook scams are below..

1. Most of the facebook scams are of the form of some videos. So avoid to click on such video link without verifying. if you don,t the person who posted the video link on your wall. So avoid to click such kind of video.

2. Try BitDefender safego


3.Scans your facebook for privacy holes with reclaim privacy.-ReclaimPrivacy.org 



4. If you believe you have already fallen victim to the Facebook phishing scam, simply log in and change your password. Other wise try to change your facebook password once a month to Avoid Facebook Scams

Facebook Attachment Uploader Owned By A Space

Oh look – another vulnerability in Facebook! It wasn’t long ago we reported New Research Shows Facebook’s URL Scanner Is Vulnerable To Cloaking.

Well this time the private messaging function has been compromised, you can attach an executable and send it to anyone as long as you put a space after the filename.

It’s not the first time I’ve seen a mime/file/etc parser be owned by a space, but I expected better from Facebook to be honest.

A security penetration tester discovered a major flaw in Facebook that could allow a person to send anyone on the social-networking site malicious applications.

Nathan Power, a senior security penetration tester at technology consultancy CDW, discovered the vulnerability and publicly disclosed it Thursday on his blog. The flaw was reported to Facebook on Sept. 30, which acknowledged the issue on Wednesday, he wrote.

Power, who could not immediately be reached, wrote that Facebook does not normally allow a person to send an executable attachment using the “Message” tab. If you try to do that, it returns the message “Error Uploading: You cannot attach files of that type.”

Facebook has acknowledged the bug (which is a pretty serious one) but it’s unknown if they’ve actually fixed it yet or not.

You can see the original blog post outlining the vulnerability here:

FacebookAttach EXE Vulnerability

Good job Nathan Power! 

Power wrote that an analysis of the browser’s “POST” request sent to Facebook’s servers showed that a variable called “filename” is parsed to see if a file should be allowed. But by simply by modifying the POST request with a space just after the file name, an executable could be attached to the message.

“This was enough to trick the parser and allow our executable file to be attached and sent in a message,” Power wrote.

A person would not have to be an approved friend of the sender, as Facebook allows people to send those who are not their friends messages. The danger is that a hacker could use social engineering techniques to coax someone to launched the attachment, which could potentially infect their computer with malicious software.

Facebook representatives contacted in London did not have an immediate response on Thursday afternoon.

The dangerous part I can see here is that Facebook allows users to send messages to anyone (with attachments) even if they are not friends. Which makes me wonder, how many random guys are sending girls they don’t know pictures of their junk as attachments on Faceobok messages…

I don’t want to know really.

Anyway this should be a fairly simple fix for Facebook and I’d imagine they have probably already fixed this or will be doing so fairly soon.

Source: Network World

How to hack facebook accounts?
Problem:
Facebook is one of the most widely used Social Networking website by many across the world . Most of them are now a days making the fake accounts both for abuse or maintaining secret relations. So, it’s no wonder that many people have started to devise methods to hack a Facebook account.

Solution:
There are two methods available which are basic common methods and advanced methods (based on user's knowledge)
Basic method includes:

         Use of

=>> Keylogger
=>> Trojan
=>> Phishing


Advanced method include
Using
=>> Metasploit
=>> Cookie Stealing


We'll discuss each one in brief ..

#Using a Keylogger
The hacker sends a client keylogger software that captures everything the user types in, including passwords. The captured keysrokes are sent by email, FTP or sare stored on the victim’s computer for later removal.
Counter : Use a firewall and don’t accept suspicious programs(specially when they are light) Using a virtual keybord also helps.

#Using a Trojan
This is same as the keyloggers if u want more control over the victom then u can use Trojans (Rats) these are remote administrator tools which give the complete control over the victim system. Relies fully on whether the user accepts the infected file or not. Trojans are quickly detected by antivirus software but packing the Trojan can get around that. Trojans or Rats can also be binded with legitimate software using exe binders.
Counter : Antivirus and Suspicion. Trojan also generate a lot of network activity when operating, so it is easy to spot them. Firewalls also work gr8.

#Phishing
PHISHING is the most commonly used method to hack into any web based systems like orkut ,gmail ,yahoo.
Phishing is proved the best and easy way to hack into any web based system u can even hack into Facebook it has high success rate . And also there is no need of any scripting knowledge like html just upload the page to any free hosting accounts and send the link to the victim. It works by creating a copy of a Login page (facebook login) ,changing some stuffs in it so as it emails the input username and password to the hacker and redirect to the REAL Facebook login page after so as the user does not get a hint of what is happening. Once the user has input his credentials, they are sent as plain text to the hacker.
Counter: The fake login page usually have to be hosted somewhere and must have a domain name. Naturally it cannot be the same as login.facebook.com so check for the URL when you are login in.

#Metasploit
I personally hate this tool. Won’t talk much about it.. damn automatic hacker
The attacker just needs the victims IP and some skill to pull the attack. So don’t just give out your Ip and don’t download stuffs from Instant Messengers as it is in this way that the attackers obtain the ip address. Beware also of emails containing strange link as clicking on a link can send your IP adrress to the hacker.

#Cookie Stealing
Involves using an exploit to steal session cookies which when injected into the hackers session (cookie injection), gives him access to your facebook account without needing to input your password. But that limits the damage he can do.
A > Downloads the HomePage.
B > Allows you to the Target’s Wall and
C > Retrieve your Target’s Friend’s List

The hacker needs your IP, skills and skills.
A software I heard that can give you control of a facebook account is FBcontroller. You have to feed it the live cookies of a victim and it does the rest.
You can get the target’s cookie by sniffing, XSS, amusing engineering, ARP Poison-Sniffing, Scroogle chase or about you like. 

for till then,

stay protected and stay connected