Farmville And 'Sex and the City 2' Used As Bait To Hijack Facebook's 'Like' Button

PRESS RELEASE

ORLANDO, Fla., June 16 /PRNewswire/ -- PandaLabs, the anti-malware laboratory of Panda Security, The Cloud Security Company, has reported the proliferation of scams hijacking the Facebook "Like" option. The attack uses eye-catching messages related to the popular game Farmville, the "Sex and the City 2" movie or the keyword sex to grab the attention of logged-in Facebook users as they browse Web pages with the "Like" button, the Facebook wall feature or messaging system.

Clicking the link brings the user to a Web page containing photos and videos of the relevant topic. Upon visiting it, a message is displayed on the user's Facebook profile indicating that they "like" it, with a text that is not controlled by the user. According to Luis Corrons, Technical Director of PandaLabs, "This distribution technique reminds us of computer worms, although this time there doesn't seem to be any malware behind it (at least yet)."

This technique, known as 'clickjacking,' uses a malformed URL with embedded code to carry out the attack. Visiting users are tricked into "liking" a page without necessarily realizing that they are recommending it to all of their Facebook friends. The real business stems from the pay-per-click system, which counts every click and generates revenue for affiliates, and from the tests offered to users on every page, which they must pay to make.

"Cyber-criminals can make money just by tricking you into visiting a Web page with ads," Luis Corrons says. "Or worse still, they can spread malware and infect you. This possibility has not yet been exploited, but it would be relatively easy and effective to do it."

PandaLabs advises users to be extremely wary of messages with striking subjects received from Facebook's internal messaging system, and to take all necessary precautions when clicking the "Like" button on external Web pages. Also, PandaLabs recommends that users refrain from entering any banking or credit card information in applications that try to sell them any kind of test.

More information is available in the PandaLabs blog.

About PandaLabs

Since 1990, its mission has been to detect and eliminate new threats as rapidly as possible to offer our clients maximum security. To do so, PandaLabs has an innovative automated system that analyzes and classifies thousands of new samples a day and returns automatic verdicts (malware or goodware). This system is the basis of collective intelligence, Panda Security's new security model which can even detect malware that has evaded other security solutions.

Currently, 99.4 percent of malware detected by PandaLabs is analyzed through this system of collective intelligence. This is complemented through the work of several teams, each specialized in a specific type of malware (viruses, worms, Trojans, spyware, phishing, spam, etc), who work 24/7 to provide global coverage. This translates into more secure, simpler and more resource-friendly solutions for clients.

More information is available in the PandaLabs blog: http://www.pandalabs.com