.gov redirections leading to spam: how did we get there?

You may have seen reports of an increase in .gov websites redirecting to spam or scam sites. This issue is the same as one we reported almost two years ago. Many .gov websites have open redirections that can be exploited by spammers. The example we detailed in February 2011 is actually still online, and so is the cross-site scripting (XSS) vulnerability that we found on the same page.

How did we get there?

Many websites want to warn users when they are leaving their domains. In the case of a .gov website, they want to make clear that an external domain does not carry the guarantee of being an official government website. This warning is supposed to add security for ens users. Facebook also uses a warning page because links can be added by anybody and Facebook cannot guarantee the safety of those URLs.

Why are these warning being exploited?

Spammers want clean URLs to bypass URL fitters and spam filters. They therefore use legitimate .gov websites to bypass security features. This warning may actually make the final URL look safer to the user by implying that the final URL has been linked and vetted, by the .gov website.

In the case of www.fmcsa.dot.gov (see our previous post), the user has only 10 seconds to read the warning before being redirected automatically. That's great for the spammer as no additional click is required to redirect the user to the spam/scam site.

These websites owners think they are adding additional security, but this decision is actually putting their users at risk. The assumption that leads to the abuse of open redirections is that the user seeing the warning has clicked on an external link on a page from the same .gov domain. Since the content on the .gov website is controlled, the external link has to be a safe link. The website creators did not think of spammers sending users directly to the warning page.

The fix

The fix is actually easy - make sure the assumption is right. This means the warning page should make sure that the redirection is legitimate - that the URL is one that has been approved.

There are a couple of way of ensuring that the redirection URL has been controlled:

Referrer

One way, not the most robust option, is to check the Referrer header to ensure the user comes from the same domain. This would stop user who clicked on a link in an e-mail, and spammers who use URL shorteners like bit.ly.

Whitelist

Another option is to store all 3rd-party URLs in a whitelist, and check against the list before making any redirection. This would prevent anybody from using the redirection with arbitrary URLs. The main downside to this approach is the overhead to manage this list every time an external URL is added or removed from the website.

Hash

The most common solution is to sign the URL. For example, replace http://www.fmcsa.dot.gov/redirect.asp?page=http://www.zscaler.com/ with http://www.fmcsa.dot.gov/redirect.asp?page=http://www.zscaler.com/&;hash=THE_HASH where THE_HASH = hash("http://www.zscaler.com" + secret). The URL is hashed with a secret key to prevent its replacement by a random address. This method is used by Facebook to guarantee the authenticity requests sent by Facebook to Facebook applications, for example.

The important takeaway for all webmasters is to understand that spammers will take advantage of any flaw in web applications. Be very careful with the assumptions you make.

Groupon scam site

groupon500.com was registered in Feb 20, 2012. The home page for the domain claims to offer a free $500 voucher for Groupon or LivingSocial, another popular daily-deal site.

groupon500.com

Users must fill out a form with their information, including a phone number:

users must share their information

To get the $500 voucher, the user must complete one offer: buy Disney Books, try a tooth whitening, etc. And with one more offer completed, they can even get a free iPod Touch!

One or more offer must be completed

The site earns money by getting users into "free" trial offers where users are charged without realizing most of the time.

The saddest part of all - this is perfectly legal. groupon500.com was published by RETAILBRANDPRIZE.COM. Search for this name in Google and you will find no shortage of people complaining about various scams.

The Privacy information, Terms and Conditions and small print are clear on what is occurring, although must users will of course ignore them. The vendor uses personal information "to provide your contact information to our marketing partners", "By Participating, You Expressly "Opt In" to "Receive Information And Grant Us Permission To Share Your Information", "Completion of reward offers most often requires a purchase or filing a credit application and being accepted for a financial product such as a credit card or consumer loan. ", etc.

If it is too good to be true, it's probably... a scam!

DreamHost: hijacked websites redirect to Russian scam

Following the Dreamhost hack, that was revealed this week, many websites hosted by the company have been hijacked to redirect users to a Russian scam page.

I've identified hundreds of websites hosted by DreamHost that contained a PHP page redirecting to hxxp://www.otvetvam.com/. Here are a few examples:

• http://www.lciva.com/wp-content/plugins/extended-comment-options/gyrewnv.php
• http://honorboundphoto.net/photos/10007-mankato_habitat_for_humanity_golf_tournament/agtruje.php
• http://ryanmasters.ca/wp-content/gallery/our-kingdom/thumbs/tyiueg.php
• http://treatmentofpanicattacks.com/wp-content/cache/supercache/www.treatmentofpanicattacks.com/category/anxiety-support/polzin.php
• http://r4theband.co.uk/content/wp-content/themes/agregado/includes/cache/gyrewnv.php 
• http://dedehaluk.com/cache/hakkinda/fgjke.php
• http://www.agustindondo.co.uk/yellowbrick/wp-content/files_flutter/modules/fgjke.php 
• http://dcstavclub.org/wp-content/themes/newzen_2.0_build_105/images/fgndnju.php 
• http://camtarn.org/gizmoblog/content/06/03/entry060305-180312/comments/fgjke.php 
• http://derek.hinchy.org/MT-5.031-en/mt-static/support/theme_static/professional_website/themes/professional-green/polzin.php
• http://ojosdelmundo.dreamhosters.com/images/comprofiler/gallery/tghreig.php

otvetvam.com promotes a common "get rich working from home" scam. On the left side, all links point to the same collection of fake testimonies from people purporting to have made plenty of money using the system.

hxxp://www.otvetvam.com/

The right side of the page, looks like Adsense ads from Google (same font, same colors, layout, etc.), but they are all links to www.tvoitube.com. This is a YouTube look-alike site, which contains a video shown promoting an online gambling site (www.cristal-casino.com).

Fake Russian YouTube site http://www.tvoitube.com/

www.otvetvam.com copied the layout of the popular Russian site, mail.ru. The source code actually reveals that the page was created from http://otvet.mail.ru/question/59882991/, which has now been blocked by mail.ru.


The hijacked sites now redirect to other websites including ru-0tveti.com, ru-0tveti1.com, etc. These domains were registered on 01/25/2012, but no websites are yet hosted at the domains.

I'm sure this is just the beginning of massive abuses on websites hosted by DreamHost.

Increase in use of PDFs for spam

In recently weeks, I have noticed an increase in the use of PDF files for spam. Instead of uploading an HTML page using a compromised account, as seen shown in a previous post "Hundreds of College and Government websites still redirecting to fake stores", spammers are instead uploading PDF files. My guess for their motivation, is that PDF files are less likely to be checked for spam than plain HTML pages.

Most of the spam PDF files contain text only.

Example of spam PDF

The goal of the spammer is to redirect users to a malicious website. This is done using a piece of JavaScript embedded into the PDF file.

JavaScript snippet from the PDF file

In this example, the user is redirected to hxxp://searchglobalsite.com/in.cgi?23 (the URL is obfuscated in the PDF file) which then redirects to hxxp://www.results-today.com/.

hxxp://www.results-today.com/

The list of websites hosting spam PDF files is very similar to what I have reported earlier. It includes college web sites, governmental sites, and wiki pages, such as the following:

• hxxp://forum.wiki.usfca.edu/file/view/file10.pdf
• hxxp://www.lapspecs.com/wiki/_media/http:cr43.pdf 
• hxxp://www.dublincore.biz/accessibilitywiki/ImplementersNews?action=AttachFile&do=get&target=dub14.pdf
• hxxp://wikiglobe.org/en/images/c/c9/Texas-veterans-home-loan.pdf
• hxxp://wiki.solusvm.com/images/c/c6/Uk-cash-loans.pdf
• hxxp://nspcommunity.net/wiki/images/e/e8/Small-loan-business.pdf
• hxxp://wiki.fossasia.org/images/6/67/Ship-loans.pdf
• hxxp://vuas.net/~dpmccann/mw/images/Real-estate-mortgage-loans.pdf

A Google search for "cialis viagra canadian pharmacy filetype:pdf site:.edu" for example, provides plenty of other examples.

-- Julien

Many University websites used for spam

In January, I wrote about many high profile websites, mostly universities, that were hijacked to redirect to fake stores. Many have since been cleaned up, but a few of these University websites are still redirecting users to new fake stores (adobe-discount.com, terrific-software.com, successful-software.net, mmpsoftstore.com, successful-software.com, successful-downloads.com, general-oem.com, etc.)

In the past 2 weeks, I've seen a significant amount of spam hosted on University websites. Spammers seem to be using compromised user accounts on wiki-like services to upload spam for Viagra, banking loans, online casinos, etc.

Fake pharmacy page hosted on the UCSF website

The list of Universities hosting such spam include:

• MIT (hxxp://nola.mit.edu/~cil/nolawiki/images/7/70/Amortizing-loan-calculator.pdf)
• Cornell (hxxps://confluence.cornell.edu/download/attachments/140416416/tab15.html)
• UCSF (hxxp://dingo.ucsf.edu/twiki/pub/People/EricAadnes/tab7.html)
• University of Pennsylvania (hxxp://george.isc-seo.upenn.edu/ocladmin/ocl/uploads/204599.txt)
• University of Massachusetts (hxxp://xserv1.umb.edu/groups/podcasts/wiki/ce448/attachments/cec02/xs57.html)
• Colorado State (hxxp://writing.colostate.edu/files/personal/108957/File_0FFC8EF8-EC2C-2238-F165D3DC0AA636A9.txt)
• Oregon State (hxxp://foodfororegon.oregonstate.edu/sites/default/files/imagecache/al65.html)
• OSU (hxxps://carmenwiki.osu.edu/download/attachments/16256437/tad44.html, down)
• WUSTL (hxxp://cssa.grad.wustl.edu/sites/cssa.grad.wustl.edu/files/imce/user1208/ed60.pdf)
• Eastern University (hxxp://ccgps.eastern.edu/members/dstore/member-blog.blog2/items/Cialis-Viagra-Online)
• University of Washington (hxxp://modular.math.washington.edu:9001/role?action=AttachFile&do=get&target=sl45)
• Oklahoma State (hxxp://asdevelopment.okstate.edu/logs/x.php?wy334=287)
• Tufts University (hxxps://wikis.uit.tufts.edu/confluence/download/attachments/29761132/ced46.html)
• National University of Singapore (hxxp://wiki.nus.edu/download/attachments/76947595/doc11.html)
• and many others

There are thousands of these spam pages. They are used mainly in e-mail spam campaigns, hidden by a URL shortener.

The university and the fraternity I attended are amongst the victims as well: hxxp://alumni.iit.edu/s/946/forms/757/100824/game31.html, hxxp://pkp.iit.edu/bog/l.php?n249=300

University websites are becoming a preferred vector for different types of spam. The vast number of sub-domains, each of them likely managed by a different group which may not have professional IT/Security skills, make them an easy target.

-- Julien

Unchecked redirection + URL shortener = Spam

Recently, I found several legitimate sites, with bad coding practices,  used to redirect users to spam sites with the help of URL shorteners. Here is how the scam works:

• The legitimate sites have a warning page for all links to external sites (i.e. http://good.com/redirect?url=http://example.com/)
• The warning page can be used to redirect users to any domain, including spam sites and malicious pages (i.e. http://good.com/redirect?url=http://spam.com/)
•  Spammers use a URL shortener like bit.ly to hide the long URL (i.e. http://bit.ly/aaaa redirects to http://good.com/redirect?url=http://spam.com/ which redirects users to http://spam.com/)

Most URL shorteners do some checks on the final URLs to prevent spammers from using their service. By using a legitimate intermediate site, the attackers prevent URL shortening services from checking the true final destination and therefore prevent blacklisting or blocking of the shortened link.

fmcsa.dot.gov

One example of such redirection pages is http://www.fmcsa.dot.gov/redirect.asp?page=http://www.zscaler.com/. Change http://www.zscaler.com/ to any URL. I've seen this page used to redirect to the rogue pharmacy canadapharm.org.

The redirection is not done by the standard Meta refresh tag (meta http-equiv="refresh" content="6;url=http://www.zscaler.com/"), but by custom JavaScript. Even if the URL shortener was looking at the HTML content to figure out the final destination, it would very likely not haven seen the redirection to an external domain.

XSS

In addition to being used by spammers, fmcsa.dot.gov includes a crosss-site scripting vulnerability: the link can be used to execute any JavaScript. The screen shot below was taken for the URL http://www.fmcsa.dot.gov/redirect.asp?page=javascript:alert%28document.cookie%29;

Cross-Site scripting on fmcsa.dot.gov

Unchecked redirections is yet another security flaw that developers need to keep in mind when developing a website. Having a website widely used for spam will likely get it blacklisted by Google Browsing and other security and spam blacklists, preventing users to access any page on the website unless they dare ignore the scary warning message from their browser.


-- Julien

High profile websites hijacked to lead to fake stores

Recently, a lot of high profile .EDU and .GOV were hijacked to redirect users to fake online stores. Google searches related to buying software ("buy windows 7 key", where to buy microsoft, "purchase microsoft word", "buy microsoft office", etc.) contain a long list of websites running on non-standard ports: www.kidsforkidsfestival.org:8080, en.jurispedia.org:4444, >www.notiuno.com:4577, etc. These links redirect users to online stores which claim to sell software at a discounted price.

Spam results for buying Windows

Major websites hijacked

The list of hijacked sites include:

• Harvard (Alexa rank in US: 875, cxc.harvard.edu)
• MIT (Alexa rank in US: 963, petar.blog.lcs.mit.edu, fig.scripts.mit.edu, hlt.media.mit.edu)
• Stanford (rank 782, mentalhealth.stanford.edu, yuba.stanford.edu, assu.stanford.edu)
• Fandango (rank 236, www.summermovies.fandango.com)

There are also governmental sites in the list, from US, China and other countries:

• openworld.gov
• paceflorida.gov
• fpa.tas.gov.au
• ezhouinvest.gov.cn
• perak.gov.my
• misiones.gov.ar
• etc.

Fake stores

The fake stores use multiple domain names, and each site looks slightly different: softsupreme.com, softsupreme.net, buysupreme.net, software-supreme.com, softbuy-download.net, softbuy-download.com, sacon.org, topoemdownloads.net, etc. I've seen more than 75 different domains so far.

Fake store

Multiple languages and other spams

Unlike the usual Blackhat spam SEO coming from the Google Hot Trends, this type of spam is targeted at multiple languages: English, French ("achat windows"), German ("Microsoft kaufen"), etc.

Hijacked sites on non-standard ports are also used for other types of spam: US student visa, Viagra, etc.

Once again spammers have managed to poison search results for popular searches. This specific spam was reported a month ago, but it still shows up in the first page of results for multiple searches.

-- Julien

Top Abuses of Open Web Proxies

While there is nothing new or Earth-shattering in this post, I thought I'd share what I have seen as the top abuses of open web proxies - as this is an everyday occurrence involving a large volume of web transactions and is a constant annoyance on the Internet.

An "open proxy" is...
In other-words a server that anyone on the Internet can forward traffic through. There are various flavors of open proxies:

• Transparent open proxy - includes originating IP address within the headers or a cookie so the traffic can be traced back to the source (common in a caching proxy setup).
  
• Anonymous open proxy - mask/hide the originating IP address of the traffic. However, there is often a tag from the proxy identifying the proxy version, etc. so that the destination server could identify the traffic as being sent through a proxy.
  
• "Elite" open proxy - provides no indication to the destination server that the traffic has been forwarded. These are the most desirable form of proxies in the underground.
  

I've analyzed many thousands of transactions on a few "elite" open web proxies, to determine how they are being used (abused). This is the general breakdown of the percentage of the transactions that I analyzed (there were over a quarter of a million total that I reviewed).

#1: Distributed Brute-Forcing:

This is the repeated attempt at trying username / password combinations to gain unauthorized access to accounts. Within the abuse of open web proxies, I have seen repeated abuse of the proxies. For example, proxies are often used to brute-force Yahoo! and Rapidshare accounts. As these target sites identify the brute-forcing activity, they block the source IP address from further attempts - so the brute-force attempts are distributed among open proxies to mask and vary the source IP addresses of the attempts.

The Yahoo brute-force attempts primarily appear as HTTP GET requests taking a variety of forms:

• <yahoo>/config/login?login=<username>&passwd=<password>
• <yahoo>/config/pwtoken_get?login=<username>&src=<source>&passwd=<md5_password>&challenge=<challenge_response>&md5=1
• <yahoo>/client/?.intl=us&.src=knowsrch&.done=http://answers.yahoo.com&login=<username>&passwd=<password>
• <yahoo>/client/clogin?login=<username>&challenge=<challenge>&response=<response>
  

The Rapidshare brute-force attempts appear as HTTP GET requests taking the form:

• <rapidshare>/cgi-bin/rsapi.cgi?sub=getaccountdetails_v1&type=prem&login=<username>&password=<password>
• <rapidshare>/cgi-bin/premium.cgi&accountid=<id>&password=<password>&premiumlogin=1&logout=&fileid=fileid&fimename=filename&ru=<ru>

Note: For both Yahoo and Rapidshare IP addresses and domain names are rotated through. For example:

Log Snippet of Yahoo Brute-Forcing

#2: Comment / Forum Spamming:

This is the mass-posting of "comments" onto blogs, forums, guestbooks, and other sites that allow open interaction with the sites. These comments include the "spam advertisement" variety ranging from porn, pharma, gambling, and pay-per-click affiliates. The other variety is the SEO variety in which the comments include links back to a page they are trying to increase search engine ranking for. Some SEO tools like XRumer include this functionality to include automatic registration and CAPTCHA bypass for posting to sites.

The comment spam HTTP GETs vary depending on the forum setup, but many followed the formats:

• <site_page>.php?act=post&do=new_post&f=<forum_id>
• <site_page>.php?do=newthread&f=<forum_id>
• <site_page>.php?mode=post&f=<forum_id>&sid=<session_id>
• <site_page>comment/reply/<story_id>
  

Snippet of logs showing the forum spamming

Following the spam from one of the forum spammers, shows that they are trying to increase the visibility to World of Warcraft auction sites (e.g., cash for WoW gold).

Sample spam message:

WoW auction site:

#3 Pay-to-click (PTC) "Cheating"

PTC/PTP/PTR sites are: pay-to-click, pay-to-promote, pay-to read ads / fill out surveys. These sites are businesses with varying degrees of legitimacy - I doubt the site owners/members pay taxes, in some cases the site owners don't pay out their members, and in many cases the members try to "cheat" the sites using things like botnets or infected machines.

The business model is basic: web site owners and advertisers pay PTC sites to promote their site. In turn, PTC members receive a fraction of a cent for each click they generate to the advertised site. PTC members also receive commissions for referring new members to sign-up. As such, new members fall into a pyramid hierarchy in which a small percentage of their revenue is given to the referring user. PTC sites have varying degrees of memberships and also limit the number of times that a member can generate revenue from a participating site.

PTC members that try to cheat the system attempt to create as many referred users under them as possible to generate a commission, and from each newly created referrer, automatically click through the participating sites, generating a daily revenue stream something along the following lines:

Revenue = ((Commission * Referrer Accounts Created) + (Referrer Accounts Created * Clicks Allowed * Participating Sites * Fraction of a cent payout)) * Number of PTC sites a member of

PTC sites are aware of members attempting to cheat, so they look at things like the source IP of the transactions and identify and ban users when multiple accounts all come from the same IP address. PTC sites also try to identify if the transactions are being forwarded from a proxy - because of these checks, "elite" proxies unknown to the PTC sites are in high demand.

Here is an example of a PTC site that I saw being "cheated":
Note: there are many of these PTC sites, and they all look fairly similar to this setup.

On the homepage of the site, top earners are displayed:
The number 3 daily earner for this PTC site is "dominic1102" - looking at logs, I see this PTC member generating a large number of referrals to make commissions and increase their click volume. Example format:

www.tuxedocatsclicks.info/index.php?ref=dominic1102

The "dominic1102" handle and client IP (123.134.112.84) was used for a number of other PTC sites as well, e.g., www.lakotaptc.info/index.php?ref=dominic1102

Log snippet of PTC cheating

#4 IRC / ICQ Masking

Users of chat networks frequently what to hide their source IP address. Whether the user is engaged in illegal activity (e.g., selling stolen credentials) or wanting to remain anonymous in case a flame war erupts followed by a denial of service attack.

# 5 Proxy Testing / Reveal host IP:

It appears that a portion of the traffic analyzed comes from automated checks to identify open proxies. Once connected, the proxy is tested to see which IP address is exposed on the Internet when traffic is forwarded through the proxy.

# 6 Other Browsing and Site Scraping

This includes a variety of things, ranging from general browsing, porn and other "not safe for work" (NSFW) surfing and regular page scraping. Based on the transaction timestamps in the logs, much of the porn surfing appeared to be automated scraping of pornographic images.

Amazon Profiles Used For Spam

Amazon's online store-front has a social networking component to it, where people with accounts can create user and seller profiles to share their interests, what they are reading, listening to, selling, etc. For the most part, anytime a site allows user-driven content to be published on the web we have seen some kind of abuse (for example, LastFM, Google Code, Adobe Groups). Amazon's profiles are no different- most appear to "profile spam" advertise various pages on the adult sites:

• adultmediareviews.com
• redspacetube.com

Some of the advertising language for redspacetube.com suggests illegal / child porn content. Language take from Amazon's site:


Google searches for both of the above domains show other sites hosting these similar "profile" spam advertisements. For example, Google Groups:
The redspacetube.com domain has been identified as redirecting users to Trojan malware (FakeAV) in the past (reference 1, reference 2). There are a lot of these Amazon profiles:


The Amazon profile abuse is not limited to porn and malware spam, but also includes pharma spam:
There are thousands of these profiles:
I have notified Amazon via their online abuse form and am in the process of trying to obtain a more direct contact for their abuse department.

Twitter ReTweet Spam (XSS)

This morning before I even logged into my system, I was receiving inquiries about the Twitter Spam going around. The source looks like:


And appears in Twitter as:

For those unfamiliar with t.co, it is Twitter's link service, which provides URL shortening as well as checks to ensure that the link doesn't go to a known malicious site (see About Twitter's Link Service for more info). You can see from the source of the tweet, that it is leveraging a cross-site scripting (XSS) vulnerability so that the scripting code following the "@" character is executed within the victim's browser, and just by mousing over the tweet you are retweeting it. The tweet name / retweet value varies. (a.no has been seen in addition to the t.co domain).

Doing a Twitter search for "Onmouseover" provides a laundry list of URLs and "victims" of this spam. The results of the spam campaign are tweet spam (annoyance) and a likely strain on Twitter services from the increase in retweets. After doing a Twitter search, after a few minutes, the search results showed over 30K more tweets since my initial search - this illustrates how rapidly spreading the XSS retweet spam is being spread.

Digging a bit deeper into this reveals that it was an Australian teenager going by the handle zzap that discovered the XSS vulnerability whereby arbitrary script following the "@" character is executed (ref. NetCraft). Cross-site request forgery and cookie stealing attacks have been demonstrated leveraging the XSS vulnerability as well. Currently there are a number of Twitter worms leveraging this vulnerability (ref. F-Secure).

Some security precautions for users to consider:

• Avoid accessing your Twitter account from a browser, consider using a Twitter client
• If accessing your account via browser turn off JavaScript or use NoScript

Update from Twitter:

New PPI Campaign

PPI being pay-per-install ...

This morning I saw some interesting transactions to:
hxxp://promoupdate.info/setup###.exe

where ### are numbers, for example, "519".

MD5: 1568edcd29629f577207d7396646b741

VirusTotal results 8/43 (report), detected as (among other names):
Win32:Hottrend-B

Turns out this is being spread through spammers, SEOers, etc. being financed in a PPI model, something that I have discussed before in the past. This time I have a screenshot to share related directly to the finance aspect of this particular PPI:


This post was created today. We can see from the PPI ad that those engaging in this particular campaign stand to make between $500 and $800 per 1000 installs (< $1 per install). The numbers in the executable, like "519" correspond to the account for the spammer/SEOer that is monetizing this. Domain: promoupdate.info Whois billing contact shows likely Russian affiliation: Here is the actual Affiliate Network setup by this guy:

Domain: twittre.net (private/masked Whois)
(note the RU nameservers)
Source of the twittre.net page actual reveals that the Affiliate website is loaded from rich-partners.com:
Domain: rich-partners.com
No surprise that the contact details are bogus, but the email address is legit, here's a past domain registered with these email credentials:
Robtex shows these other domains (all likely other PPI sites) on 91.188.60.10 (Sagade Ltd. <- not a surprise for some) in Latvia, hosting promoupdate.info:

'LikeJacking' - What is it?

In the past few days I've had a number of people send me URLs that they received from friends on Facebook that seemed unusual and asked me what is this? In each of these cases, the answer was 'LikeJacking' - while this has been discussed in the security community for the last month or so (e.g., Sophos blog post), the general public seems fairly unaware of this technique. The term has been adopted enough, that there is a Wikipedia page for it, with a very straight-forward definition:


For those unfamiliar with Facebook's 'Like Button' - "The Like button enables users to make connections to your pages and share content back to their friends on Facebook with one click" additional details can be read here.

Many of the sites involved with LikeJacking are NSFW (contain nudity). However, below is a recent example of sites that I can safely take some screenshots of (sorry, no nudity on this blog):

Example: hxxp://tattooshaha.info/

Viewing the source of the site, we can see the META tags used for the information that will propagate to Facebook:
And a transparent iframe to for the visitor to 'Like' the site:
Why? Well the simple answer is to drive up the number of visitors to your site though Facebook 'Like' advertisement. For this particular example, clicking on the image directs users to hxxp://coolest-bathroom.info/tattoo/, and viewing the source of the page shows that JS source is loaded from cpalead.com:
The purpose of this campaign appeared to monetize click-throughs with cpalead.com:

I've seen this technique in play in a number of other LikeJacking campaigns, e.g.,
hxxp://www.101hottestwomen.com/
hxxp://102hottestwomen.com/
hxxp://103hottestwomen.com/video.html
hxxp://104hottestwomen.com/video.html
hxxp://105hottestwomen.com/video.html
hxxp://106hottestwomen.com/video.html
hxxp://107hottestwomen.com/video.html
hxxp://108hottestwomen.com/video.html
hxxp://109hottestwomen.com/video.html
hxxp://110hottestwomen.com/video.html
hxxp://111hottestwomen.com/video.html

The source of this one shows that if your visiting from Germany, Finland, or Spain IP you load from cpalead.com, otherwise you load from adscendmedia.com (CPA affiliate):

Adobe Groups Abused

We've seen Google Groups and a host of other sites that permit user driven content to redirect to malware or other nonsense. This morning I saw a rash of Adobe Groups posts redirecting to fake pharmacy sites (pharms / pills sites). For example:

hxxp://groups.adobe.com/index.cfm?event=post.display&postid=22600
... most all postids between (that's more than 2K posts!) ...
hxxp://groups.adobe.com/index.cfm?event=post.display&postid=25000