full-disclosure - Re: Facebook seems to think my Arch Linux box has malware on it

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <CACEGnzGVb7JWZUmAD3bVOOjtj9eN8MnLhBEVmQD=M80QtLwOUw@mail.gmail.com>
Date: Fri, 20 Jan 2012 14:05:25 -0800
From: Sebastian Rakowski <seb3255@...il.com>
To: Gage Bystrom <themadichib0d@...il.com>
Cc: full-disclosure@...ts.grok.org.uk
Subject: Re: Facebook seems to think my Arch Linux box has
 malware on it

Appears legit.

https://www.facebook.com/help/?faq=292760454081612

-Sebastian

On Fri, Jan 20, 2012 at 1:29 PM, Gage Bystrom <themadichib0d@...il.com>wrote:

> Yeah good luck with reproducing it cause it REALLY sounds like a mitm or a
> phishing attack trying to get people to download fake av. I would do a dns
> lookup and then compare those results to that of a public web service, and
> save the links for the AVs to check if they have any malicious history
> associated with them.
> On Jan 20, 2012 1:21 PM, "Wesley Kerfoot" <wjak56@...il.com> wrote:
>
>> It turns out that it was a problem with firefox. However, I do not
>> believe I had any malicious addons or extensions for a few reasons. 1) I
>> only had 4 extensions, adblock plus, pentadactyl, firebug, and noscript.
>> 2) they were all vetted (presumably) by mozilla.
>>
>> I believe, and this is simply speculation, that the problem may have been
>> caused by noscript stopping/interfering with some scripts on facebook.
>> Facebook would assume it was malware interfering with the site, and attempt
>> to block it. I am 99% sure my browser was not really compromised.
>>
>> I'm going to try and reproduce it later.
>>
>>
>> On 19 January 2012 22:57, Byron Sonne <byron.sonne@...il.com> wrote:
>>
>>> Hello,
>>>
>>> > “Your computer has malware!” Facebook says to me.
>>>
>>> I am really curious to know, assuming that everything you've said is
>>> accurate, how they determine you've got malware. This is rather curious.
>>>
>>> The more I think about it, the more I wonder if something's come between
>>> you and facebook pretending to be official, hoping to trick you into
>>> downloading something.
>>>
>>> Cheers
>>>
>>> --
>>>  freebyron.org
>>>
>>
>>
>> _______________________________________________
>> Full-Disclosure - We believe in it.
>> Charter: http://lists.grok.org.uk/full-disclosure-charter.html
>> Hosted and sponsored by Secunia - http://secunia.com/
>>
>
> _______________________________________________
> Full-Disclosure - We believe in it.
> Charter: http://lists.grok.org.uk/full-disclosure-charter.html
> Hosted and sponsored by Secunia - http://secunia.com/
>

Content of type "text/html" skipped

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/