Facebook Spam Attack Due To Browser Vulnerability

The biggest problem Facebook has been facing for couple of years has been the spam and the malware attacks on the site. The issue has been denting the image of the company, which is why it had even asked third party vendors and ethical hackers to join its anti-hack, anti-spam “Bounty” program.The situation appears to have gone out of hand now as users have been reporting wide spread attacks on their accounts.

Over the last few days users have been flooded by links and images of porn and violence on their accounts. This time though, the effect is cascading onto other accounts at a much faster rate than Facebook had expected, which is why the company has been caught with its pants down. Facebook does have a robust spam elimination infrastructure in place to tackle any emerging threats, but something tells me its failing big time. Irish Times reports:

Spammers have apparently been taking advantage of the new photo-enhanced layout of the site – which means that when “friends” post comments on photographs the picture is automatically posted onto the news feeds of friends.

Users are outraged and don’t seem to be in a forgiving mood, quite rightly facebook has missed its mark in a big way by not providing a safe and secure environment for people to socialize. Latest reports suggest the company has nailed the culprits and is on its way to take the matters with the legal authorities. Overall, events like these leave a bad taste amongst the users — and opens up a window of opportunity for rivals to pitch in.

The company has issued an update and has clarified that hackers exploited browser vulnerbilities:

Protecting the people who use Facebook from spam and malicious content is a top priority for us, and we are always working to improve our systems to isolate and remove material that violates our terms. Recently, we experienced a coordinated spam attack that exploited a browser vulnerability. Our efforts have drastically limited the damage caused by this attack, and we are now in the process of investigating to identify those responsible.

During this spam attack users were tricked into pasting and executing malicious javascript in their browser URL bar causing them to unknowingly share this offensive content. Our engineers have been working diligently on this self-XSS vulnerability in the browser. We’ve built enforcement mechanisms to quickly shut down the malicious Pages and accounts that attempt to exploit it.

We have also been putting those affected through educational checkpoints so they know how to protect themselves. We’ve put in place backend measures to reduce the rate of these attacks and will continue to iterate on our defences to find new ways to protect people.

Image by mike lowe via Flickr