Facebook infested with cut and paste Javascript survey scams

May 10, 11 Facebook infested with cut and paste Javascript survey scams

by Dave Michmerhuizen – Security Researcher

The Social Networking monitors at Barracuda Labs are reporting a virulent outbreak of survey scams on Facebook.  These attacks use a variety of social engineering topics and spread via different Facebook APIs,  but all use the same initial “cut and paste JavaScript” exploit to spread within the Facebook ecosystem.

Osama Death Video

Osama Death Video

500 Facebook Credits

500 Facebook Credits

Free McDonalds

Free McDonalds

Official Time Spent App

Official Time Spent App

See you in 20 Years

See you in 20 Years

Dad walks in on daughter

Dad walks in on daughter

Who hacked your Facebook

Who hacked your Facebook

Who Visited 1.01

Who Visited 1.01

 

How it works

All of these pages exploit a poorly understood feature of modern web browsers – the ability to execute Javascript entered into the URL bar.    You can demonstrate this yourself by entering the following in the URL bar of your browser

javascript:alert("Thanks for reading the Barracuda Labs blog!")

and pressing the Enter key.

JavaScript executed in this manner does so in the context of the currently loaded webpage.  If that’s Facebook and you’re logged in, then the JavaScript has access to all the APIs and credentials that the authenticated Facebook page has.   You can even demonstrate that by putting this example in the URL bar

javascript:alert(document.cookie)

The resulting message box displays the cookie (if any) that is associated with the currently loaded web page.

 

These scam pages all try to trick you into copying a bit of JavaScript onto the clipboard and pasting it into the URL box like so

Typical Cut & Paste instructions

Typical Cut & Paste instructions

It’s no accident that this looks confusing since the scammer doesn’t want you to think too hard about what you’re actually doing.  “Just follow the instructions!” is what they say.   What this particular snippet does is to tell the currently loaded web page to load and run a much larger JavaScript file from elsewhere on the Internet, in this case,  http://hapenceiver.info/lock.js.

The JavaScript file that is loaded in goes right to work spreading the scam to your friends.  There are  a number of these files in circulation, all of them parameter-driven, so easy to use that would-be scammers don’t even need to know how the script works.  Just change the fake message and the scam landing page and they’re good to go, like in this small sample of one script

Javascript sample

JavaScript sample

The bulk of the JavaScript spreads the scam virally using various Facebook APIs such as  messages, invitations and posts to friends walls.

 

At one time these sorts of survey scams were spread via Facebook applications that attempted to trick you into “liking” them.   A Facebook application requires scammers to apply for an AppID and to have a server.    This “Cut and Paste JavaScript” approach only needs a cheap domain or even a Facebook page.  Either are easy to set up, and with such a lowered bar to entry the scams are showing up everywhere.   Prompting users to cut and paste JavaScript isn’t new but it’s sure meeting with a lot of success.

 

What happens

Executing the JavaScript file that the code sample is from will post a message to every one of your friends walls, like so

Post on friends wall

Post on friends wall

If a friend clicks through, they see the attack page, hosted on Facebook

attack page

attack page

and if that friend follows the directions, not only do they spam their friends, but they proceed on to a survey page, in this case disguised as a “security check”.

Fake "Security Check"

Fake "Security Check"

Following one of these all the way through lands you on the payoff screen.

Cell Phone number reqested

Cell Phone number reqested

The “security check” says it wants to send the results to your cell phone.   Your cell phone number is really being requested in order to sign you up for a premium SMS service, as shown in the small type at the bottom of the page.    This is how many Facebook survey scam pages make their money and why they are so prevalent.

 

Barracuda Networks recommends you exercise special care when visiting links posted in your friends’ news feeds.    Barracuda Web Filters and the Barracuda Web Filtering Service block access to these sites.