Facebook: Porn, Violent Images Were Self-Inflicted

Surprising images on Facebook walls are result of self-cross-site scripting vulnerability, social media giant says

Security gurus at Facebook have spent the past few days trying to track down the source of a new hack that caused pornographic and violent images to appear on the walls of its users and their friends. Today, the social networking giant has an answer.
Recently, we experienced a coordinated spam attack that exploited a browser vulnerability, Facebook said in a statement issued to reporters. Our efforts have drastically limited the damage caused by this attack, and we are now in the process of investigating to identify those responsible.
During this spam attack, users were tricked into pasting and executing malicious JavaScript in their browser URL bar, causing them to unknowingly share this offensive content, the statement says. The social engineering giant did not say which browsers are affected by the vulnerability, which it calls self-XSS. New enforcement mechanisms and back-end measures have been put in place to shut down the attack.
In a
blog
, Zscaler researcher Mike Geide calls the attack self-inflicted JavaScript injection. The copy-and-paste of JavaScript into the browsers URL bar is a technique that has been used in other Facebook exploits, most recently in social-engineering attacks playing on the death of Osama bin Laden, he notes.
But while most attacks these days are financially motivated, the appearance of disturbing images on Facebook walls appears to be simple malice, says Sophos researcher Chester Wisniewski in his
blog
.
The bigger question is what motivated the attackers to use this flaw in such a strange way? Wisniewski asks. We investigate lots of Facebook scams here, and I would guess that nearly 100 percent of them lead to some financial payout for the scammer. This seems to be a purely malicious act.
Have a comment on this story? Please click Comment below. If youd like to contact
Dark Readings
editors directly,
send us a message
.

Last News
▸ Hack Your Hotel Room ◂ Discovered: 23/12/2024 Category: security	▸ Website hacks happened during World Cup final. ◂ Discovered: 23/12/2024 Category: security	▸ Criminal Possession of Government-Grade Stealth Malware ◂ Discovered: 23/12/2024 Category: security

**Cyber Security Categories**
Google Dorks Database	Exploits Vulnerability	Exploit Shellcodes

CVE List

Tools/Apps

News/Aarticles

Phishing Database

Deepfake Detection

Trends/Statistics & Live Infos

Tags:
Facebook: Porn, Violent Images Were Self-Inflicted