Facebook Scam Tricks Users into Hacking Themselves
Many security experts are fond of saying that humans are the weak link in any security system. Scams like this one prove them right.
The latest Facebook scam promises to give people the ability to hack into anyone's account. But follow the instructions and you'll only end up hacking your own page, via a trick called Self-XSS, thus making yourself vulnerable to new scam campaigns. Well, don't dish it out if you can't take it, right?
MORE: Best Android Antivirus Software 2014
The scam appears as either an email or a Facebook post on your Timeline purportedly from a friend of the victim. "Hack any Facebook account following three steps," the scam promises. It then instructs readers to open Facebook in a web browser and go to the Facebook page of the person they want to hack. Then right-click anywhere on the page and from the popup menu select Inspect Element. This brings up an HTML editor at the bottom half of your Web browser.
In this editor, the scam instructs readers to copy-paste a string of code. But, unsurprisingly, the code does not do what the scammers claim it does. Rather, this code grants the scammers access to your own account.
This kind of hack is called cross-site scripting, or XSS, because it involves compromising a Web page by injecting a script (a short piece of code) that then affects that site's integrity. XSS is considered a vulnerability, and is probably something that the browser should fix, not Facebook.
Meanwhile, Facebook has added Self-XSS to its list of Security Threats, with a warning not to paste any strange code into browsers. But Facebook hasn't announced any plans to patch any part of its code that makes this attack possible.
Once the scammers are in control of your account, they can use your account to post more of these fake instructions, or launch even more cyberscams. They may also have access to your email and password, so if you use the same login credentials at any other Web service you'll want to change them immediately.
If you see this kind of spam on Facebook, you should flag it as such by clicking the arrow in the upper-right corner of the post and selecting "This is Spam." If you fell for this scam, you should contact Facebook immediately. You may also want to change your password, but it's likely the scammer doesn't need your password to compromise your account, since presumably you executed the script while you were already logged into Facebook.
Email jscharr@tomsguide.com or follow her @JillScharr and Google+. Follow us @TomsGuide, on Facebook and on Google+.
Copyright 2014 Toms Guides , a TechMediaNetwork company. All rights reserved. This material may not be published, broadcast, rewritten or redistributed.
