full-disclosure - facebook messages worm

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <Pine.LNX.4.62.0808061623450.14967@linuxbox.org>
Date: Wed, 6 Aug 2008 16:44:03 -0500 (CDT)
From: Gadi Evron <ge@...uxbox.org>
To: bugtraq@...urityfocus.com
Cc: funsec@...uxbox.org, full-disclosure@...ts.grok.org.uk
Subject: facebook messages worm

Hi all.

There's a facebook (possibly worm) something malicious sending fake 
messages from real users (friends).

The sample also has a remote drop site (verified by someone who shall 
remain nameless).

This is possibly zlob, not verified. Thanks Nick Bilogorskiy for his help.

Infection sites seen so far are on .pl domains.

The AV industry will soon add detection.
Facebook's security folks are very capable, so I am not worried on that 
front.

It's not that we didn't expect this for a long time now, but...
Be careful. Some users know to be careful in email.. but not on facebook.

Note: unlike 2003 when we called everything a worm and the 90s when 
everything was a virus--this is a bot which also spreads/infects on facebook.

 	Gadi.

--
"You don't need your firewalls! Gadi is Israel's firewall."
     -- Itzik (Isaac) Cohen, "Computers czar", Senior Deputy to the Accountant General,
        Israel's Ministry of Finance, at the government's CIO conference, 2005.

     (after two very funny self-deprication quotes, time to even things up!)

My profile and resume:
http://www.linkedin.com/in/gadievron

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/