Blog for hpHosts, and whatever else I feel like writing about ....

Tuesday, 4 August 2009

ALERT: Malvertizing on Facebook and

This investigation started after I read a report by a fellow member of the security community that his mother had called him downstairs "because her screen had been filled with warnings and download boxes whilst she was on Facebook's 'Owned" site'", and he asked for help to find the malvert. I also saw on the GAIA site that lots of people were having problems with browser hijackings on that site, and that a poster's "mother just got the exact same redirection from Facebook": ... 761261_31/

Facebook incident:

The malvertizement that I caught on Facebook was displayed with a Facebook application -

The domains involved in the hijack were,,,,, and before the victim finally ends up at a fraudware site (screenshot of network sessions below).

Facebook said on their blog on 25 July 2009 that advertising displayed by Facebook applications is "not from Facebook but placed within applications by third parties". I suspect that Facebook will face an ongoing problem if they are going to allow “third parties” to independently source and manage advertising to display in conjunction with Facebook Applications.

Malvertizement - incident:

The malvertizement that I saw on is visually identical, but some domains are different. You will see that the bad SWF is coming from instead of (screenshot of network sessions below).

Malvertizement URL:

Both malvertizements have been reported to the appropriate parties.

Read more

No comments: