Last year, we talked about scams and spam circulating on Facebook in our whitepaper. Social networking scammers often reuse common lures to trick users, such as offering free products or additional features that are not available on their network of choice. What these scammers do differently is find new ways to get more eyeballs to view their specific links. Whether it is likejacking or even convincing users to paste code (an external JavaScript file) into the browser address bar, these scammers are relentless.
Just recently, we published a blog about the Facebook Black scam that has been spreading. While that scam continued to spread, we found two old lures being reused, and also two identical Google Chrome extensions being pushed onto the end user.
"Additional feature" lure
Users of social networks have often requested certain features and wondered whether they would ever be implemented on their favorite sites. One of the most commonly requested features across all social networks has been a way to see who has visited one's profile. This feature has never been available, yet this lure has been used in scams across many of the most popular social networks over the years.
Figure 1. Photo-tagging spam claiming additional feature
In fact, this lure—commonly found on social networks—is identical to the one used in the Facebook Black scam we posted about recently. Users are redirected through an iFrame on a Facebook page and then taken to a website where they are enticed to install a Google Chrome extension.
Figure 2. Browser extension claiming additional feature
Installing the extension does nothing—except present the user with a set of surveys to fill out in order to unlock the additional feature. The feature never gets unlocked. The only thing that happens is the scammers make money off of every survey completed successfully.
Figure 3. Scammer survey
"Get something free" lure
Let’s face it: people like free stuff. But free stuff on social networks is not really free. The newest products are the most valued by users and scammers know this. This is why they continue to reuse this lure.
Figure 4. Web page claiming to get something free
For instance, in February Sony announced their new video game console, PS4. It is not scheduled to arrive in stores until the year-end holiday season. However, that has not stopped scammers from attempting to trick users by offering a free PS4 test unit that they can keep.
Figure 5. Browser extension claiming to get something free
The Web page for this scam claims that users can get a voucher for a free PS4. In reality, there is no voucher. There is just a browser extension created by scammers.
When users install this browser extension, JavaScript files are downloaded onto the user's computers. These files then perform various actions in the user's Facebook account, like creating a Facebook page with an iFrame and posting a photo the user's friends are subsequently tagged in (see previous Figure 1). And this is how the scam spreads.
Protection
Symantec customers are protected against these types of attacks by our Web Attack: Fake Facebook Application 3 IPS signature.
Be cautious when you see offers for free products on social networks, especially products that are highly sought after. Also, if a feature is not currently available on a social network, chances are there is a reason that it is not available. Do not install browser extensions from unverified sources—even if they offer free products or access to an unavailable feature—and be especially suspicious of anything that is promoted aggressively on your social networks.
Google, for their part, removes malicious Chrome extensions as they find them and are improving their automated systems to help them detect items containing malware.
However, in the next post we provide instructions on how to remove these scammer browser extensions yourself, and how to clean up your Facebook timeline from all the spam left by scammers.