How Facebook Likejacking Can Be Used To Trigger Malicious Scripts.

Facebook Like Jacking is another method of click jacking, where a user clicks a hidden like button that will share a link with the user’s friends without the user’s knowledge.

Although Facebook has reduced the Like jacking incidents, recently there was rise of likejacking scams.Therefor I decided to write a post explaining the mechanisms how these likejacking scams work. I’ve written a post about the malicious Facebook browser extensions that can be found in my old blog.

I’m not going to talk about what is clickjacking and likejacking, I’m going to show the mechanism of how likejacking works and how it can be used to trigger a malicious script once the Like button is clicked.

So a typical clickjacking scam page are most of the time designed to looks like YouTube, Facebook page or video frame to trick the user in thinking it’s a legitimate website, well it can come in any form. The bottom line is the website is designed to trick the users.

So I went to the clickjacking website that’s there in the Naked Security blogpost, and saved it’s code. You can find the HTML code of the website here : http://nopaste.me/paste/14304159654fdd8bd82d01c

Basically it’s a simple website that’s made to look like a video frame, it’s a pretty simple HTML code with some javascripts. If you start looking from the code from the top, the first thing you should see is the meta tags.


<meta property="og:title" content="[VIDEO] Snake Eats MAN!"/>
<meta property="og:site_name" content="[VIDEO] Snake Eats MAN" />
<meta property="og:image" content="http://s15.postimage.org/5ybac4awr/snake_eats_man.jpg" />
<meta property="og:description" content="CAUGHT ON TAPE- A Giant Snake Swallows Up A Zookeeper in Front of Hundreds of People!" />
<meta property="og:type" content="website" />
<meta property="fb:admins" content="38305883" />

These meta tags allow a malicsious attacker to change the picture, title, message of the post that’s being posted on the Facebook time line irrespective of the contents of the website.

Then comes the Like button code, it’s a bit different in this webpage. Usually it’s the same Like button code. Click to see the large image.

However there is a small modification to this code, the like button is hidden with the small CSS trick, so the user won’t know that he’s clicking a like button.


div.transbox
  {
  opacity:0;
  filter:alpha(opacity=0); /* For IE8 and earlier */
  }

So the hidden Like button iframe code will look like this, click to see the large image.

In this website, it’s used like this, click to see the large image.

With the help of some more CSS trick the hidden Like button can be placed near a fake play button image, so that when the play button is clicked, the user will click the hidden Like button and without knowing the user will share the post in his timeline.

Up to here it’s pretty much simple stuff, however there is a small function calledĀ “FB.Event.subscribe” let’s a malicious user to trigger an event can be used to trigger a malicious script once the like button is clicked. Most scammers use this to load a survey that will give scammers money. However, this can also be used to trigger a malicious javascript once the Like button is clicked, even if the LikeĀ  button is not hidden.

In the following likejacking scam it’s used like this,

<script charset="utf-8" type="text/javascript">
FB.Event.subscribe('edge.create', function(response) {
        window.location = window.money_page;
});
</script>

However, a malicious attacker can modify the script to look like this, this will load a malicious javascript once the like button is clicked. So the victim will not suspect.

<script charset="utf-8" type="text/javascript">
FB.Event.subscribe('edge.create', function(response) {
 //EVIL SCRIPT HERE
 //REDIRECT PAGE
 //MALWARE DOWNLOAD
});
</script>

Advertisements