Unfixed XSS vulnerability at apps.facebook.com

Security researcher homeostasie ft p3lo, has submitted on 30/11/2009 a cross-site-scripting XSS vulnerability affecting apps.facebook.com, which at the time of submission ranked 2 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 10/03/2015. It i...

Facebook Blocks XXX Clickjacking

Facebook administrators have blocked a clickjacking exploit that displayed images of a scantily clad woman on profile pages without first prompting the user for permission. Read the full article. The Register...

Facebook XXX Worm Replaces Profiles

Security researchers have identified a new worm spreading across Facebook, luring people out to adult Web sites and automatically replicating itself across people’s profile pages. Read the full article. internetnews.com...

Facebook Administrator Groups Hijacked

As of this morning, an anonymous group hijacked more than 200 Facebook groups and renamed them “Control Your Info”. Pasted on each group’s Wall was a message announcing that it had been “hijacked” and reminding members to be careful about controlling personal information on social networking site...

Google Reader Used in Koobface Attack

The attackers behind the insidious Koobface worm have taken to using Google Reader accounts that they control to spread the worm through shared Reader items. The infection method–which has been used before by Facebook worms–is another indication of the resilience and changing tactics the malware...

Facebook, MySpace Fix Subdomain Errors

Facebook and MySpace have fixed errors that could have allowed data to be given out from its subdomains. A Dutch developer, Yvo Schaap, discovered the flaw and wrote on his blog: “A “more invasive and hidden exploit could harvest all the user’s personal photos, data and messages to a central serv...

Researchers Find Trojan Using Facebook

Researchers at Symantec have discovered a trojan that uses Facebook to communicate with a control and command server. Dubbed “whitewell” this malware spreads via email, contacts the mobile version of Facebook and uses its Notes section to perform actions based on the Notes titles. Andrea Lelli...

Facebook Wins $711 Million in Spam Case

Social networking website Facebook was awarded $711.2 million in damages relating to an anti-spam case against Internet marketer Sanford Wallace, court documents show. The site filed an anti-spamming case against Wallace in February for accessing people’s Facebook accounts without their permissio...

Facebook Photo Uploader 4 ActiveX Control Buffer Overflow

$Id$ This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more information on licensing and terms of use. http://metasploit.com/framework/ require 'msf/core' class Metasploit3 'Facebook Pho...

Unstoppable New Phishing Attacks Blanket Facebook, Twitter, Hotmail

How quaint seem the days when naïve hacker wannabes phished PayPal logons, then posted them on IRC chat channels, to try to make a few bucks — but mostly for bragging rights. That was circa 2002-2003. Fast forward to the present. At this moment, Facebook is being blanketed by two high-volume emai...

Facebook Open Redirector

0000000000000000000000000000000000 000000000000000000000 00000000000000000000000000000000000 0000000000000000 00000000000000000000000000000000 + Facebook Redirection + Author : 599eme Man + Contact : [email protected] -----------------------------------------------------------------------------------...

New Koobface Campaign Spoofs Adobe's Flash Updater

The botnet masters behind the most efficient social engineering driven botnet, Koobface, launched a new campaign currently spreading across Facebook with a new template spoofing Adobe’s Flash updater embedded within a fake YouTube page. Read the full story zdnet.com/Dancho Danchev...

Facebook URL Cross Site Scripting

0000000000000000000000000000000000 000000000000000000000 00000000000000000000000000000000000 0000000000000000 00000000000000000000000000000000 + Facebook XSS URL String Evasion + Author : 599eme Man + Contact : [email protected] + Special Thank : Syltrox66...

Koobface, Twitter Attacks Growing More Sophisticated

GENEVA — The attacks and scams that have been affecting users of Facebook, Twitter and other popular social networking sites are continuing to evolve and improve, as the attackers learn more about their victims and refine their tactics, experts say. The poster child for these attacks has been the...

Facebook Attack: Personal Info Theft via CSRF

This video is a demonstration of an attack exploiting a vulnerability in Facebook. It is a companion video to this blog post quaji.com that describes and discusses the hack. In a nutshell, a Facebook user’s personal is stolen. The only thing he does is view a regular, legitimate forum site...

On the Twitter DDoS Attacks, Apple and Microsoft Patches

Threatpost editors Ryan Naraine and Dennis Fisher discuss the DDoS attacks against Twitter, Facebook and LiveJournal and delve into Apple’s Mac OS X patch and Microsoft’s Patch Tuesday plans. SHOW NOTES: UPDATE: Twitter Suffers DoS Attack Apple Warns of Mac Attack Risk via Image Files Microsoft...

UPDATE: Twitter Suffers DoS Attack

Twitter was the target of a sustained denial-of-service attack Thursday morning, an attack that took the site offline for several hours. Twitter’s service went down around 9 a.m. EDT and was back up around noon, while Facebook’s site also experienced problems that may have been the result of a Do...

More Privacy Controls Coming to Facebook

From The New York Times Riva Richmond Facebook launched a beta test today that foreshadows new privacy controls coming to “Publisher” – the box at the top of your home and profile pages where you add content. The changes will let you easily specify who among your friends gets to see that specific...

Facebook Scam: I'm Stranded In London. Send Money!

From DarkReading Gadi Evron Facebook users are facing a new threat, 419 scams in chat form, masquerading as friends. I know because it just happened to me think: 419 scam. An “acquaintance” sent me a message using Facebook chat that said, “Hi.” Easy enough. I replied in kind. Then she told me a...

Simplistic Facebook phishing attack seeks userIDs and passwords only

From The Last Watchdog Byron Acohido There’s power in simplicity. That’s the upshot of the phishing attack now bombarding Facebook users. Many FB’ers are receiving messages titled, simply, “Hello.” The body of the text contains a brief imperative sentence: “Check areps.at” or “Check bests.at”...