F-Secure Introduces Safe Profile App For Facebook

F-Secure have made available a Facebook app called Safe Profile. It's job is to inform user about the most important safety and privacy issues. After a scan Safe Profile gives a rating for the account's privacy, displays any potential issues and makes recommendations for more secure settings. Safe Profile won't store any personal data.

Safe Profile is currently at a beta stage. To try it, log into your Facebook account and search for "Safe Profile Beta".

Source: F-Secure press release

Facebook To Check Web Links

Malicious web links is one of the problems that have brought negative publicity for Facebook. To help reducing this problem Facebook has teamed up with security company Websense. In near future, all web links published in Facebook will be checked to filter out malicious ones.

When user clicks a link in Facebook it will be sent to Websense for security classification. If the link is found to be malicious user will be given options to either access the link at one's own risk or return back to the previous screen.

More information can be read from Websense blog.

Tips for Safer Facebooking From F-Secure

F-Secure has published a 6 tips containing list for safer facebooking. Those can be viewed in the company's Safe and Savvy blog here.

Fake Facebook Password Reset Confirmation Email Spreads Trojan

MX Lab warns in their blog about Bredolab trojan that is spread in fake Facebook Password Reset Confirmation email messages.

The body of message looks like this:

Hey <"receiver here"> ,

Because of the measures taken to provide safety to our clients, your password has been changed.
You can find your new password in attached document.

Thanks,
The Facebook Team

Attached file contains variant of the trojan. Virustotal uploaded sample was detected bad by 14/41 scanners.

More details in MX Lab's blog.

New Koobface Variant On Loose

Security company Panda Security warns in their blog of new wave of Koobface worm that is spreading in social networking site Facebook. Spam messages come with text "CooooL Video" and a web link. When the link is clicked, victim is redirected to a Koobface controlled server that routes to a fake codec site. On fake codec site victim is shown "Flash Player upgrade required" -message that tries to make user open a malicious executable file.

Source

New Koobface Variant Spreads In Facebook

Security company Trend Micro warns in its blog about new Koobface worm variant.

Facebook user may get a message that looks like it was coming from friend's Facebook account. The message contains friend's picture and name with a link to a video.

The link opens a spoofed version of YouTube site. In the centre of the site there's a message telling that user must install Adobe Flash Player Update.

By clicking install -button user won't get any Flash update. Instead of it Koobface worm's new variant (detected as WORM_KOOBFACE.AZ) is downloaded.

Facebook users are not the only group in danger. The worm searches for cookies created by the following sites first:

* facebook.com
* hi5.com
* friendster.com
* myyearbook.com
* myspace.com
* bebo.com
* tagged.com
* netlog.com
* fubar.com
* livejournal.com


Then it connects to a respective site using login credentials stored in the gathered cookies. It then searches for an infected user’s friends, who are then sent messages containing a link where a copy of the worm is downloaded. It also sends and receives information from an infected machine by connecting to several servers. This allows hackers to execute commands on the affected machine.

Users of mentioned social networking domains are advised to ignore described messages, and refrain from clicking links in unsolicited messages.

Koobface Spreading On Facebook

Social networking service Facebook told to Computerworld that they're quickly updating their security systems to minimize further impact of malware spreading on Facebook. Passwords of infected accounts are being resetted and spam messages are being removed. Facebook is also coordinating with third parties to remove redirects to malicious content elsewhere on the web.

The guilty one in the problem is a new variant of Koobface worm which is targeting Facebook. Last summer its earlier variants caused harm to Facebook and MySpace users.

In a nutshell, bad guys try to fool Facebook victims by sending spam with a link claiming to contain a video. When user clicks the link (s)he is redirected to a page that then displays a fake error message claiming that Adobe System Inc.'s Flash is out of date, and prompts user to download an update. Instead of being an update the executable file installs variant of Koobface worm which in turn installs a background proxy server that redirects all Web traffic.

On infected system at least all searches made on Google, Microsoft and Yahoo search engines are redirected to find-www.net web address. The hackers are making money by redirecting users' searches to their own results, collecting cash from the ensuing clicks.

Facebook has posted a short message on its security page acknowledging the worm's attack. The notice urged users whose accounts had already been compromised to scan their PCs for malware and then reset their passwords.

Malware Spreads In Social Networking Services

Security company Kaspersky Lab warns about new worm named as Koobface which uses social networking services, Facebook and MySpace to spread itself. Thus far four different variants of the worm exist.

Koobface makes infected systems part of botnet which clients spread malware links using friends lists of MySpace & Facebook. "The messages and comments include texts such as Paris Hilton Tosses Dwarf On The Street; Examiners Caught Downloading Grades From The Internet; Hello; You must see it!!! LOL. My friend catched you on hidden cam; Is it really celebrity? Funny Moments and many others."

Links in messages guide user to site containing video clip. If the user tries to watch the clip (s)he's been shown a message that asks to get the latest version of Flash Player to be able to watch the clip. Instead of the latest version of Flash Player, a file named as codesetup.exe is downloaded to the victim machine. That file is actually Koobface worm.

“Unfortunately, users are very trusting of messages left by 'friends' on social networking sites. So the likelihood of a user clicking on a link like this is very high. At the beginning of 2008 we predicted that we'd see an increase in cybercriminals exploiting MySpace, Facebook and similar sites, and we're now seeing evidence of this. I'm sure that this is simply the first step, and that virus writers will continue to target these resources with increased intensity”, says Alexander Gostev, Senior Virus Analyst at Kaspersky Lab.