Facebook phishing: manual session hijacking

We have reported a number of Facebook phishing pages and scams on this blog. Attackers always come up with clever ideas to fool users in order to obtain their credentials. One of these phishing tricks is a "poor-man" session hijacking attack whereby the user is fooled into copying and pasting a Facebook URL containing the session ID or other credentials into a malicious page. I'll describe such an example that I spotted this past weekend.

The phishing page starts with the usual bait, a video. This time, no sex, but instead an opportunity to watch "Jackie Chan died after perfecting a deadly stunt. Jackie Chan falls from a building of 12 floors."

Jackie Chan died!

The user must click to verify his age, another common trick to get users to click on the page. This displays a list of steps to "verify your age" which involve clicking on another link, copying a link from the window opened, and submitting the data.

Steps to "verify" the user age

The new window points to Facebook. The window is too small for the user to understand what he is copying. Also, instead of opening a page, the URL used is "view-source:https://www.facebook.com...". This makes it one step harder for the user to understand that the window displays a page from Facebook.

Popup window open by the phishing page

When the user copies and pastes their Facebook URL into the 3rd party web page, they're also sending their authentication token used share content. Once this is done, the scammer can now post content on the user's behalf.

Fortunately, Facebook reacted quickly to this particular scam. The Facebook  popup is not valid anymore and it shows the following warning:

Warning from Facebook

When subsequently logging into Facebook after viewing the scam, I also received a warning about phishing pages:

Warning about phishing pages

It looks like Facebook has reacted much faster than they have in the past and added additional warnings for end users. I was asked by Facebook to review my timeline for any suspicious activating just after I logged in. Hopefully more Facebook users will learn about these phishing techniques and will be able to spot them early on.

Facebook Scam for Stalkers

If you are like me, you might feel bad about leaving your dog home alone all day while you are at work.  So to alleviate his boredom, I've let him sign up for his own Facebook.  Being new to the social media scene has already resulted in one tragedy. Well, my dog has done it again.  This time he was paranoid over whether his girlfriend from across the street was cheating on him.  So of course when he sees the new FBStalker26.com, he must try it.

On Version 26! So Advanced. So Legit.

Being a human, I know that this is obviously a phishing attempt trying to trick my dog into revealing his username and password to Facebook or worse.  Usually a Facebook scam's success is determined by the paranoia of who is looking at your profile or how many free iPads you can win.  Once you realize that, these phish attempts are almost elementary to recognize.

Always look at the address bar before entering your creds.

 The link from that photo will take you immediately to a new page where you are meant to log in again with your Facebook credentials.  A quick glance at the address bar will show you that you are not in Kansas anymore.  Don't do it!  Don't enter that information!

Oh no you did it...Now your username/password have been compromised, they still won't have an easy time into your account due to higher security policies from Facebook.  Unfortunately, my dog was gullible enough to enter in his security question and answer, only to be disappointed by a 404 error immediately after that entering his data.  Looks like he'll never know who is stalking him now, but don't worry...he won't have access to his own Facebook account for much longer.

Facebook Malware campaign

We're seeing a massive campaign of malware distribution through Facebook look-a-like pages that started just before the new year.

Malicious page distributing malware

These pages are using the free DNS and hosting provider .tk. This provider has been used for many spam and malware campaigns in the past. Here are some of the domains used:

• janejcfprofile.tk
• natalieclolyu.tk
• rosemaryrloveyouur.tk
• sabrinadjoyys.tk
• catherineufcitisfun.tk
• rosemaryiiqsuper.tk
• laurenaensweety.tk
• carlyqwowdv.tk

So far, we've seen several hundred of such sites. They prompt the user to download a file with various names, such as:

• YouWhoreGIF.exe
• YouNiceJPG.exe
• IamNiceBMP.exe
• IamNicePNG.exe
• YouFunnyJPEG.exe
• IamLolBMP.exe
• and may more

Only 1 AV vendor detects them as malicious at this time!

Looking at the source code, all the .tk domains load their content from another website through an IFRAME, with content from:

• liwwh.eqeki.com
• ngdy.hrdhm.org
• lsmxz.totyn.net
• cnpz.nukoq.com
• ...

These pages then redirect to a third URL on 208.131.138.217, hosting the malicious executable:

• 208.131.138.217/132.html
• 208.131.138.217/208.html

The malicious file is generated by http://208.131.138.217/imagedl.php.

As usual, do not run files downloaded on random Internet pages.

Free provider x90x.net hosting numerous Facebook phishing sites

In the long history of free hosting and DNS providers abused (co.cc, pastehtml.com, etc.), x90x.net can now be added to the list, as it is being used to host many Facebook Phishing sites in a variety of languages:

• faceb000k.x90x.net
• jebemtakra-pisdfa-asdasdsds-ddfs.x90x.net
• mesnaindustrija-goranovic-m-e-s-n-a.x90x.net
• dft3.x90x.net/fbcd.html
• d3xt0pcr3w.x90x.net
• etc.

www.mesnaindustrija-goranovic-m-e-s-n-a.x90x.net

d3xt0pcr3w.x90x.net

dft3.x90x.net/fbcd.html

x90x provides free hosting on their sub-domain

A little bit more research showed that many other types of scams and spam content are hosted on x90x.net sub-domains. Here are a few of them:

• Fake Google page

mygoogle.x90x.net

 This site does not appear to be functional.

• Links to Canadian Pharmacies

vmdygoa.x90x.net

•  forex.com phishing site

jasf.x90x.net/tag/chase/

• Porn (no screenshot!)
• and much more....

The hosting provider is also used by legitimate sites.  It is very risky to host any important website with a free provider which is going to get abused over and over. co.cc has been blacklisted by Google Safe Browsing in the past, meaning all Firefox/Safari/Chrome users were prevented from visiting any of the websites hosted under co.cc. I believe that a $10/year domain name is really a must for any website. Do not rely on a free domain such as those provided by x90x.net that could soon be blacklisted.

An example of likejacking (Facebook clickjacking)

Last year, we released Zscaler Likejacking Prevention, a free browser extension to protect users from clickjacking leveraging Facebook widgets. Since then, I've seen many websites using Likejacking as their "business model" (i.e. this is how they get traffic to their spam site).

Usually, these spam websites try to get the user to click on a specific area of the page where they have hidden one or more 'Like' buttons. Recently, we found a website where the hidden Facebook 'Like' button follows the mouse throughout the page. No matter where you click, you hit the Like button.

Hidden Like widget follows the mouse

The technique to hide the button, has however been seen previously. There are hidden DIV elements with the opacity set to 0.0.1, which makes them transparent, although they are in the foreground. The position is set to absolute so that it can move anywhere on the page.

Here is a video that explains how it works:

You can get the free Zscaler Likejacking Prevention extension for Firefox, Google Chrome, Safari and Opera on our website.

Facebook used to make scams look legitimate

One of the recurring web spam themes I saw in 2011, was the "Work from home and make $X,000/month" scam. In some variations of the well-known and well-used scam, websites are set up to look like a well-established newspaper with a front-page (fake) article about making a lot of money from home.

Here are a few examples I saw earlier this year (now offline):

Fake NBC website at hxxp://news11bizopp.com/landing.php

Fake news site at http://www.nbcnews43.com/?news/articleid=8351

The new scam I found this week included an interesting new trick and is still online.

Fake news site at hxxp://newsday7.com/

The site is set up like the previous scams - it claims to be an online, established newspaper, which displays an article about someone who is making a lot of money, working from home.

At the top of the picture, which shows a woman and a girl, on the right, you can see a Facebook Like button that says "214,217 people recommend this. Be the first of your friends." Apparently, 214,217 went to his page and clicked on "Like", making this page look more legitimate.


At first, I thought this was a fake Facebook widget. But this is the real deal, as seen from the page HTML code:

Real Facebook widget (click on the image too see in full screen)

There is however a trick. The "Like" widget does not point to hxxp://newsday7.com/, but rather to http://www.facebook.com/CBS. As you can see in the images taken from the two websites, the number of Likes is the same:

214,217 Likes on hxxp://newsday7.com/

214,217 Likes on http://www.facebook.com/CBS

Facebook allows you to embed any Like widget on any website, even if the domains or URLs do not correspond. Scammers are using this trick to appear more legitimate, by tricking visitors into thinking their website has been visited and liked by many people.

My guess is that this technique is very effective, and will be used more and more by spammers and scammers.

Zscaler Likejacking Prevention for Opera

Along with Firefox, Chrome and Safari, Zscaler Likejacking Prevention is now also available for Opera. You can download it on the official Opera add-on site.

Zscaler Likejacking Prevention on the Opera extensions site

The Opera version works the same as the Google Chrome version, with a similar popup to obtain more information about the Facebook widgets on the current page.

Zscaler Likejacking Prevention for Opera in action

The red/green icon that indicates if a page is safe or suspicious, is located on the far right of the Opera browser. I believe it would have been more visible if it were part of the URL bar, as I did for Chrome and Firefox, but unfortunately, Opera does not permit such a placement.

Icon on the right of the screen, after the search bar

Preferences page

Limitations

There is one big limitation in Opera: the extension cannot detect hidden Facebook widgets in frames or iframes. This is due to restrictions in the Opera extension framework, which don't permit frames and iframes to be linked to the top window. Scripts can be injected in frames and iframes, but it is not possible to know which tab they belong to and the background page cannot communicate with the frames and iframes inside a tab.

In practice, 90% of the hidden Facebook widgets I've seen do not use layers of frames and iframes. Zscaler Likejacking Prevention will help users to stay safe from Facebook spam for the majority of spam pages

Version 1.0.9

I'm continually improving Zscaler Likejacking Prevention on all platforms. The latest version available is 1.0.9. You can download it and the other plugins we have released, on our Tools page.

Firefox

I expect version 1.1.0 of the Firefox Zscaler Likejacking plugin to be approved on the official Mozilla add-on site within a few days.

-- Julien

Facebook: Anatomy of Self-Inflicted Javascript Injection

Many are already familiar with "likejacking" (a form of "clickjacking") in which a user is tricked into clicking on and interacting with the Facebook "like" button -- this has been one of the most common vectors of abusing Facebook. For example, the "like" button may be hidden behind an image such as a picture of an embedded YouTube video with a play button. Zscaler released a free browser plugin for identifying and warning of hidden "like" buttons in webpages. However, a recent campaign on Facebook in which inappropriate pictures (porn, mutilation, etc.) were spread through user's social networks was conducted via a different mechanism that many are unfamiliar with: self-inflicted JavaScript (JS) injection. This post will explain the basic technique and some of what we are seeing on Facebook.

Many people are unaware that they can run JS directly from their browser's URL bar. Go ahead and try it. Here is a benign script that pops up a test alert in your browser, enter this into your URL bar: javascript:alert('test');

If you're running NoScript it prevents running JS directly from your URL bar to combat social engineering attempts to get users to unknowingly run something malicious, and will provide the following dialog message:

Otherwise, here is a screenshot from entering this in Safari:

In this example on Safari, I was initially on the www.apple.com page before I launched the JS in my URL bar - so you can see the Apple page in the background and the JS alert message appears to have come from www.apple.com. This would change depending on whatever page I was on when I launched the JS in the URL bar - additionally the JS could be modified to interact with or modify content on the current page. In other words, you could run JS that could completely modify the Apple page locally in your browser or interact with buttons or links. This is an important concept to understand and is a technique that is being used to do damage to Facebook accounts / profiles.

The "same origin policy" is a security concept used in JS and other browser-side scripting languages that prevents scripts from one website from accessing methods/properties on another website. So when you visit your friend's blog, he is unable to have JS execute and automatically interact with your Facebook account. Instead he includes a link at the bottom of his blog to interact with facebook.com and pass a parameter to Facebook saying that you "like" his post (the "like" button). For example,

www.facebook.com/plugins/like.php?href=HIS_BLOGPAGE&width=120&height=22&layout=button_count&show_faces=false&action=like&colorscheme=light

There is an exception to the "same origin policy" in which you can execute script locally within your browser to interact with a page (shown above in the apple.com example). Developers and browser plugins (e.g., greasemonkey) take advantage of this fact to alter various aspects about a webpage. Bad guys are also taking advantage of this fact, by social engineering users to copy/paste or type JS in their URL bar to perform unwanted actions. While logged into Facebook, the JS can automatically perform actions in your account such as, "liking" content or messaging your friends.

Facebook has cleaned up most of the offensive content from in the recent campaign. But doing some specific searches I was able to find some examples of this self-inflicted JS injection technique being used on Facebook.

The most common case, are Facebook groups that ask you to join and then enter in some JS into your URL bar. For example,

This JS loops through all of your Friends and suggests / invites them to the group. In other words, this JS performs a bulk invite of a group to all of your Friends. Simple, right?

Here is an example of a more complex and malicious JS I found on FB:

The strings in the JS are all hex encoded, below is the unescaped version:

This JS generates an Facebook invite message to your friends with the message containing an IFrame to: bit.ly/9CxGhY?82

Visiting this shortened link, shows that Bit.Ly is aware of the abuse and warning users from following:

The shortened link was to the now down site:

hxxp://aagmphxa.facebook.joyent.us/goog/index1.php

There are many examples of past abuse from various "facebook.joyent.us" sites, here for example.

This technique is not a new technique - Zscaler has reported past abuse examples using this Self-Inflicted JS Injection method, for example:

• "Hey are you still there" FB scam
• "You look so stupid in this video" FB scam
• Facebook Osama bin Laden death campaigns (specifically, the spyingonyou.info/osama/a.js example)

Be careful of all actions you take while online, to include copying and pasting content into your URL bar.

Building Zscaler Likejacking Prevention for different browsers

Facebook Likejacking Prevention is the second plug-in that I've released for multiple browsers (Google Chrome, Safari and Firefox). It is technically much more complex than the previous one, Zscaler Safe Shopping.

Each browser offered different challenges. As promised in the previous blog post, I will provide details of what was required to port the plugin to different platforms.

Facebook Likejacking Prevention 1.0.8

Before I start on the technical details, I'd like to remind all users to upgrade to the latest version of the add-on (currently 1.0.8). In Firefox and Chrome, go to Add-ons or Extensions, and check for updates. For Safari users, please install the latest version from our website. I have fixed a couple of bugs, and made several improvements in the detection of suspicious pages.

This is a fairly long and technical post. Don't hesitate to post a comment if some points are not clear.

The Architecture

There are two main components in the plugin. The first feature involves finding  the Facebook widgets inside a page. These widgets are iframes hosted on www.facebook.com. Then the plugin needs to inspect the containers, the HTML elements that contain the IFRAME, to figure out if the widget is hidden or not. The protection (widget removal or explicit confirmation) needs to be applied on each widget, as chosen by the user.

The second element involves displaying relevant information to the user: a quick view indicating whether the page is suspicious or not and a more detailed view for additional information.

Google Chrome

Extensions on Google Chrome are comprised of two parts:

• A background page which has access to the browser: local storage, extension options, tab events, etc., but it does not have access to the content of the tabs, i.e the HTML content
• A content script injected in each page/frame/iframe, which has access to the HTML content (read and write), but does not have access to the browser or other tabs. The content script injected in one frame does not have access to other frames or iframes, even within the same tab.

The background page and the content scripts can communicate with each other by sending messages.

In Zscaler Likejacking Prevention, the content scripts are charged with finding the Facebook widgets, inspecting the containers, and sending the information back to the background page. The background page aggregates  the information for each tab, and decides which action to take on the tab content depending upon the options and whether or not suspicious elements where found.

This architecture works well for the add-on, except in these two scenarios:

Layers of Frames/Iframes

Facebook widgets can be loaded inside an iframe or a frame, which can itself be loaded inside an iframe, etc. In order to inspect the container, the content script would have to cross the boundaries of the frame/iframe it was injected in. But this is not allowed by the browser. So doing the DOM inspection for the container from bottom (the Facebook widget) to top (the main document) by each injected script is not possible.

Instead, container inspection has to be done with a mix of bottom up and top down. The content script in the main document does have read access to all the frames/iframes which it resides in. After all Facebook iframes are found, the container inspection is done from the widget to its containing iframe (bottom up).

The parent container is found with the parentNode property of a DOM element in Javascript. Unfortunately, the parentNode of an iframe is shown as null.  In order to find the container of an iframe, it has to be found from the top document down to the iframe based on it's SRC attribute. Finally, a new score is computed by the main document and sent back to the background page. If an action needs to be taken, the background page sends a message to all injected scripts inside the tabs.

Late loading

The page is inspected as soon as it is loaded, in order to apply the protection quickly. However, Facebook widgets can be inserted at any time, including after a page has finished loading. So the page score must be recalculated every time a new iframe is loaded.

To solve the problem, when the background page gets a message from an injected script inside a Facebook iframe, it checks if any Facebook widgets were already found in this tab. If not, the background page asks for a new evaluation of the page.

Icon and Popup

Chrome has the best architecture for showing information for a specific page. It was very easy to show an icon associated with a popup for a given tab. No problem there.

Safari

Safari (Opera and Firefox Mobile as well)  has the same plug-in architecture as Google Chrome, with the separation between the background page (referred as global page by Safari) and content script. Therefore, it did offer the same challenges as Chrome.

However, some technical limitations in Safari did bring a few more issues...

One way communication

While each injected script can send a message to the global page, the global page can only send a message to the main page, not to each frame/iframe. To be more specific, the global page can reply back to a message from a frame/iframe, but cannot initiate the message to them. That means once it has aggregated the information from all content scripts, it can push a message to apply the protection to the main page only. To get around this limitation, each frame/iframe has to send a message to the global page regularly to check if there is any action to be taken.

Storing the aggregate information

In Chrome, each tab has a unique ID. The aggregate information is associated with the tab ID. There is no such ID in Safari. Instead, the information can be saved as a property of the tab. Unfortunately, if the tab is moved to a new window by the user, the associated property is reset, and the information is lost. I have to save the information as a tab property (the most accurate way), but also based on the URL in case the tab is moved. If there are different tabs with the same URL, but different content, the data can be mixed up.

Limited UI

I had to find a creative way to get around the UI limitations of Safari. First of all, it is not possible to have an icon in the URL bar as I do in Chrome and Firefox. Then, toolbar buttons are black and white only, and can have only 2 states. I need 3 states for the button: no Facebook widgets on the page, safe page with Facebook widgets and suspicious page.

Instead of an icon or button, I had to use a toolbar. I also had to take care when it came to hiding and showing the toolbar when the user switched tabs, loaded a new URL, etc.

I actually had to use two toolbars, because each is limited to a fixed height of 30 pixels. One toolbar is not enough for all the information and links I want to show. The detailed information and actions have to be shown on a second toolbar!

Firefox

Firefox has a centralized plugin architecture: the browser and all the tabs, including their content with read and write permissions are available from the same JavaScript file. That made it much easier to inspect DOM elements with several layers of frames/iframes.

However, it was harder to detect new frames/iframes being loaded or added by just listening to page load events. The solution I use is to listen to HTTP requests for HTML documents and re-inspect the tab every time a new element was sent.

UI

The UI was a bit more tricky than in Google Chrome. There are icons associated with a popup called Page action. Unfortunately, the popup content is limited to a piece of text and one button. This does not work with the information and actions I needed to offer.

Instead, I had to create my own "Page Action" by adding and removing an icon in the URL bar as needed and showing a toolbar at the top of the tab when the user clicks on the icon for more information. Overall, it required a bit more work than Google Chrome, but was much easier than for Safari

Conclusion

It was interesting to see the impact of the different browser architectures and limitations on my plugin. Safari was by far the hardest platform to work with. DOM inspection and manipulation was the easiest in Firefox, while displaying information in the UI was best done in Google Chrome.

It is a bit disappointing that it was not possible to have the plugin look the same in the different browsers. Google has the layout I really wanted and I found the UI restrictions in Safari very problematic.

-- Julien

Protect your self against Facebook spam: Zscaler Tool for "LikeJacking" Protection

Facebook widgets, including the "Like" buttons, are often used to spread spam and propagate scams. Typically, the scammer creates a page with a fake video player. Users are tricked into clicking on Facebook Like buttons hidden behind a fake Play button. This is called Likejacking, and it's a specific form of clickjacking. I have posted a Youtube video showing in June that explains how these Facebook widgets are disguised.

I previously posted a bookmarket - a piece of JavaScript that can be executed on any page to display hidden Facebook widgets on the page. I wanted to go a step further and offer good protection against Likejacking, or any type of clickjacking with Facebook widgets (Facebook comments, Facebook login, etc.).

You can install the free Zscaler Likejacking Prevention tool for Firefox, Google Chrome and Safari. The extension offer 2 primary features:

• Information about the page: does it contain Facebook widgets? Are these widgets hidden?
• Protection against hidden widgets: the application requires explicit confirmation from the user when clicking on a Facebook widgets on a suspicious page

Page information

On Firefox and Chrome, an icon is displayed in the URL bar when a page contains at least one Facebook widget. If the page is suspicious, meaning hidden widgets were detected, the icon has a red background. You can use http://www.zscaler.com/research/plugins/likejacking/example.htm as an example of a suspicious page.

Suspicious page found in Firefox

If the page is safe, meaning the widgets are not hidden, the icon background is green. This allows users to have a quick understanding of the safety of the page.

Safe page found in Chrome

Safari has the same functionality, but uses a toolbar instead of an icon.

Suspicious page found in Safari

You can obtain more information on the page -- either by clicking on the icon, or "More options" in Safari -- including:

• how many widgets were found on the page
• whether the page is suspicious or not
• what protection was applied on the Facebook widgets

Information, and actions, for a page with Facebook widgets (Chrome)

The popup (Chrome), or toolbar (Safari and Firefox) also let users take some action on the page: they can whitelist the current domain (see more below), manage their preferences, or display the hidden Facebook widgets on the page.

You can also report back to Zscaler, any page that was classified improperly by clicking on "Report an error". This will open a new tab in your browser and  send you to a form on the zscaler.com website. We will use this information to improve the add-on.

Display hidden widgets

As you can see in the Youtube video, it is possible to expose the hidden widgets. The extension can modify the source of the page (opacity, height, weight, z-index, overflow, etc.). You can try this feature on http://www.zscaler.com/research/plugins/likejacking/example.htm.

Hidden Like buttons exposed in Firefox

Explicit confirmation

You can choose your level of protection in the preferences:

• Delete all Facebook widgets - Choose this option if you never use "Like" buttons on external sites. You can always whitelist a domain to keep the widgets on a particular site.
• Always ask for explicit confirmation - A popup will warn you that you clicked on an element that is trying to post to your public profile. You can decide to stop the action, or to let the page post to your profile. This is a good option if your rarely click on "Like" buttons.
• Ask for explicit confirmation only on suspicious pages with hidden widgets - This is a good balance between security and productivity. It is the recommended setting.

Explicit confirmation in Safari

You can also whitelist domains so that no protections are applied on a given site. The popup, or toolbar, can show you what action was taken on a page -- for example confirm, remove, or ignore (no protection applied).

Extension preferences in Chrome

Some notes

The extension does not affect the ability to use the main Facebook site; it protects users only on other sites that use widgets from Facebook.

Some Facebook widgets are hidden by design. This is normal, and the the extension will not list them as suspicious and will not apply any protection on those.

I will post another blog on the process of creating the plugin for different browsers to explain the challenges I faced on each platform.

-- Julien

The Web has still not switched to SSL-only

In November 2010, the release of Firesheep highlighted the dangerous consequences of not using secure HTTPS transactions. Following this, I provided some of the reasons why the web has not switched to SSL-only yet. There have been some improvements since, notably Google+, which works only over HTTPS, and from Twitter.

But those are very small steps. A lot more needs to be done.

SSL by default

One trend involves offering HTTPS as a new option. Facebook and Twitter took this path. Unfortunately, the option is usually disabled by default. Half of the users do not understand what this option does and the other half is not aware of the new feature well hidden in their profile!

HTTPS option under Security settings in Facebook

HTTPS should be enabled by default, perhaps with the option of disabling it for the very few users having problems with it.

Facebook

While Facebook has fixed the 2 bugs I mentioned in the earlier post - SSL: the sites which don't want to protect their users, it is practically impossible to use HTTPS on Facebook. The problem arises from the fact that the use of SSL breaks most of the applications I've tried on the platform. I used to get error messages, now users are warned that they need to switch to HTTP. They have to logout, and login again, to get HTTPS back.

Most Facebook Apps cannot be used with HTTPS

HTTPS cannot be used for popular applications like CityVille from Zynga. I doubt many users will take the hassle to logout/login constantly to switch back to SSL.


Insecure cookies

I've seen HTTPS implemented incorrectly on many sites, including Facebook. The main purpose of HTTPS is to hide the user cookies, so that tools like Firesheep cannot be used to hijack a user session. That means the HTTPS cookie should never be sent over HTTP. There are two ways to achieve this:

1. Use the secure keyword when sending a cookie with Set-Cookie. This mean the cookie can be sent by the client only over HTTPS
2. Use a different sub-domain that support HTTPS only (like encrypted.google.com) and restrict the cookie to this sub-domain

Otherwise, when the user connects to the website over HTTP the user session is vulnerable. Unfortunately, Facebook uses the exact same cookie over HTTP and HTTPS, without securing it. If you type "facebook.com" in your address bar, you will send your cookie in clear text, even if you are then redirected to https://www.facebook.com/ and simply visiting a site that uses a Facebook widget, a Like button for example, leaks your user session in plain-text, even if you check the "Secure (HTTPS)" option in your profile. Nowadays, it is a challenge to not visit a website that does not contain any element from Facebook...

My Facebook cookie leaked on a random web site (Like widget)

In the end, it does not really matter whether you use HTTPS or not for Facebook. Your Facebook cookie will be leaked when visiting other websites anyway.

Google

Google did the right thing with Google+. The website works with HTTPS only and there is no way to use HTTP. User cookies cannot be sent in clear text.

You can also use their search engine over HTTPS, unlike Bing, which does not offer a secure alternative.

But Google still has some work to do on the rest of their current web applications. For example, the Google Personal Home Page cannot be accessed over HTTPS (users get redirected to HTTP) and Adsense, the major adverting network, does not support HTTPS, which leads to a Mixed HTTP/HTTPS warning for sites would would like to use SSL.

Mobile

The situation is even worse in the mobile space. Most of the applications used on smartphones and tablets need to contact a web server to function: to retrieve advertising (Admob/Adsense Mobile), to get data from a web service, etc. But there is no way for the user to know whether sensitive information is sent over HTTP or HTTPS. There is no UI element equivalent to the lock shown in browsers and no visibility into the URLs. Researchers have illustrated that mobile developers cannot be trusted to secure communications, as all too often, they send user credentials in plain text.

While some websites have taken a few steps to protect the users, there is still a great deal to do. HTTPS should be enabled by default on all new web sites requiring user authentication. HTTPS should not just be required for login, it should also be required for all requests sent with a cookie.

-- Julien

The "Dad walks in on Daughter.. EMBARRASSING!" Facebook scams

The "Dad walks in on Daughter.. EMBARRASSING!" Facebook scams have become very prevalent. I listed a few examples on our new blog, Zscaler Analyst Scrapbook. I'll go into more detail in this post.

A Google search for "Dad walks in on Daughter.. EMBARRASSING!" shows hundreds of spam pages. They are mostly new domains, set up just for the purpose of scamming users.

Google search shows spam pages

Some of the domains identified are:

• the-ping.org
• t401.org
• ectoplax.info
• 20yearstimephoto.info
• 20yearsphoto.info   

Links can also be found by searching directly on Facebook:

• apps.facebook.com/cooljoysole/
• apps.facebook.com/dadwalksin/
• apps.facebook.com/fgdfhgdfgdf/  
• www.facebook.com/pages/Dad-walks-in-on-Daughter-Embarrassing/217239648303953

Facebook users should remember that Facebook applications are not necessary reviewed by the Facebook staff, and can be harmful.

Besides being wide spread, this spam is interesting because it shows the wide variety of scams and spam associated with Facebook. Here are a few.

Like-Jacking

A very common technique used with Facebook spam involves likejacking. The spammer entices users to click on a link or image, often on the premise of watching a funny video. However, the page contains a hidden Like button that is unknowingly triggered by the user. The Like button is placed in a hidden iFrame or hidden DIV tag that follows the mouse.

This technique is used to spread the spam page via Facebook profiles to get more users to visit the page. This likejacking technique can be found, for example, on gadgetera.net or t401.org.

Fake video layer hiding a Like button

On these pages, the likejacking technique used is somewhat unique: 23 Like Buttons are placed in the center of the video, below what looks like the play button. The opacity is set to 0, meaning these buttons are totally transparent and cannot be seen. When a user believes he is clicking on the play button, he is actually clicking on one of the like buttons.

Like buttons rendered visible

You can check the details in this video:

Script injection

This second example is much more harmful. The attackers ask users to copy and paste Javascript code into their Browser URL bar. The Javavascript has full access to contents in the open browser tab. It can grab the user session cookie and send it to the attacker. This gives the attacker full access to and control of your Facebook account.

Script injection

In the example, the attackers didn't try very hard to hide their intentions. They load the malicious Javascript from a page called owned.php!

These types of script injection used to be done through cross-site scripting (XSS), or other vulnerabilities. Now unfortunately, attackers are finding that they can bypass security protections as users are willing to do anything, including willingly executing malicious code!

Comment-Jacking

Instead of using a Like button to spread a page, spammers can also use comments. On hxxp://kingsoz.org/, the user is asked to enter a captcha to access the video. The result is actually entered into a Facebook comment box (you can see the "comment" button).

User asked for a Captcha

Similar to the "Like" button, this adds content to the victim's Facebook profile and shows up in his friend's News page.

Spam link on my user profile after visiting hxxp://kingsoz.org/

Survey, Software Installation

Getting the spam page hosted in a victim's Facebook profile is only the first step for a scammer. Ultimately, they want to make a few bucks from each visitor. A common technique used involves asking visitors to fill out a survey, install software, or to click on advertising to verify that they are in fact a human and not an automated script. The spammers get paid for each action.

After getting 5 spam pages added to my profile, filling out 3 surveys and getting my Facebook account stolen, I was still not able to watch this video :-)

-- Julien