Facebook’s announcement of its “Like” button has been a gift — to scammers and malware authors who take advantage of its simple Javascript to write exploits.
Such “clickjacking” exploits first began appearing last week, though with no “payload” other than to spread pages virally throughout the site. However, anti-virus companies such as Sophos are warning that it could turn into a much more aggressive technique that will end up installing malware on peoples’ machines when they think that all they’re doing is going to hit a “Like” button on an innocent site.
Graham Cluley at Sophos explains that it exploits a bug (or is it a feature?) of pretty much every browser: if you overlay an invisible iframe on top of a link on a page, then you can’t tell if you clicked on the link — or the iframe.
ADVERTISEMENT
As Lockergnome points out, “Clickjacking is not an operating system specific exploit, but a browser-based attack so it impacts Windows, Mac, and Linux users the same.”
In the first round of exploits, which went around last week, the messages that led to the iframe exploit included “LOL This girl gets OWNED after a POLICE OFFICER reads her STATUS MESSAGE.”, and “This man takes a picture of himself EVERYDAY for 8 YEARS!!” and finally “The Prom Dress That Got This Girl Suspended From School.”. (Give the scammers some credit — they know how peoples’ minds work, as well as how websites work.)
The next wave had targeted links that displayed text that says either, “Paramore n—a—k—ed photo leaked” or “Justin Biebers Phone Number Leaked!” The overall method was the same, though. Users following the link were taken to a page saying “Click here to continue if you are 18 years of age of above.”
ADVERTISEMENT
Clicking anywhere on the site then launched an invisible iframe, which contains a Facebook ‘Like’ button, thus spreading the link to more and more users.
Simon Willison, web developer extraordinaire and occasionally of this parish, notes on his blog: “Since Likes show up in your Facebook stream, it’s an easy attack to make viral. The button is implemented on third party sites as an iframe, which would seem to me to be exploitable by design (just make the iframe transparent in the parent document and trick the user in to clicking in the right place).”
He spotlights the problem simply. “Clickjacking prevention relies on not allowing your UI elements to be embedded in a hostile site, while the Like button’s functionality depends on exactly that.”
It’s another example of the collision between fabulously idealistic ideas of how to join the entire web together, and make communication easier, and the reality, which is that there’s always someone looking to make a quick (dishonest) buck. The “Like” button is a nice idea, but lacks security robustness.
As ReadWriteWeb remarks: “The problem has to do with the overly simple way Facebook has implemented the “like button” feature. Non-developers can plug a URL into a wizard that generates code that can be copied and pasted anywhere on the Web. Like buttons created this way or manually, via handwritten code, will function properly even if they point to a webpage that’s on a different domain from the page where the button is being hosted.”
Facebook can’t do a great deal about it, because the Like button and associated code sit outside Facebook itself; and it can’t detect whether someone has overlaid an iframe or similar bit of malware on the site.
The only recourse open to them is to spot users and pages that seem to be passing on recognised scams and blocking exits from Facebook to them, or incoming links from them. That, however, is going to be an arms race to compare with the one against email spammers.
“Clickjacking” was the term created by Jeremiah Grossman and Robert “RSnake” Hansen, the security researchers who brought the technique to public awareness in late 2008, notes The Register.
© Guardian News & Media 2010