Facebook fights new Koobface worm, another rogue app
Yet another rogue app spreads on Facebook, as does new variant of Koobface worm that tricks users by including the name and photo of an intended victim's Facebook friend.
Like flies to cow dung, rogue apps are swarming to Facebook.
The popular social-networking site has been hit by what's believed to be the fourth rogue app in a week or so and is investigating the spread of a new variant of the Koobface worm, according to security firm Trend Micro.
The Koobface worm spreads via a message from a Facebook friend that includes a link to what looks like a video, Rik Ferguson wrote on the Trend Micro blog.
The landing page displays the name and photo of the friend. Clicking the "install" button redirects to a download site for the file "setup.exe," which is the new variant of Koobface dubbed Worm_Koobface.az.
"Previous versions didn't have all these complexities and automation built in," Jamz Yaneza, a senior threat analyst and researcher at Trend Micro, said in an interview. "This new variant has a back end doing all the modifications."
Once the worm infects a computer it sends cookie information to a remote server, of which there are as many as 300 in the operation, he said. "Now you can use a third-party connection via the Facebook API," he said. The cookie information can include unencrypted log-in information, enabling attackers to masquerade as a legitimate Facebook user, Yaneza added.
The worm connects to a site using log-in credentials stored in the gathered cookies and sends messages to the friends of an infected user. It also sends and receives information from an infected machine by connecting to remote servers and allows attackers to execute commands on infected machines.
The worm is targeting users of other social-networking sites, including MySpace, Bebo, Friendster, hi5, MyYearbook, Tagged.com, Netlog, Fubar, and LiveJournal.com, Trend Micro said. An earlier version of Koobface hit Facebook
Facebook spokesman Barry Schnitt said the company is investigating the new variant of Koobface.
Meanwhile, another rogue application is spreading that displays a message that says "Closing Down! You reported them for violating their terms and policies," Trend Micro said. Once the application is installed it spams itself to a victim's friends.
The news comes after word of Facebook swatting down a similar rogue app late last week and another one a few days before that.
"It seems that Facebook as an attack platform may be coming of age," Ferguson wrote in an e-mail.
Facebook implemented an app verification policy late last year after getting criticized for not vetting its apps enough. But the security and privacy "seal of approval" policy is voluntary.
Yaneza said it should be compulsory for all Facebook apps, like Apple vets all the iPhone apps.
Facebook's Schnitt said the company is looking into the app and would disable it if it turns out to be deceptive or malicious.
"It is important to note that we've built security into Facebook Platform by preventing any app, including the rare malicious app, from accessing sensitive information like contact info," he said in an e-mail.
"Only a small percentage of Facebook users have been affected by security issues, including Koobface," Schnitt said. "We're updating our security systems to minimize further impact, including resetting passwords on infected accounts and identifying and deleting malicious content sent by the virus. We've posted a note about this on our security page to educate users.
In a separate e-mail, Schnitt added: "Worms like koobface update relatively frequently. Koobface is on its 28th version of the binary since it first started attacking social networking sites last summer. The difference is essentially in the webpages hosting it - the landing page where users are tricked into downloading a fake update that installs the virus. Users should be very suspicious of strange messages from friends and should always confirm a software update is necessary through the vendor's website (Adobe.com, etc...) before downloading it from a third party."