Social Community Script Authentication Bypass

Exploit for php platform in category web applications ============================================= Social Community Script Authentication Bypass ============================================= 1-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=0 0 1 1 /' \ /'\ /\ \ /'\ 0 0 /, ...

Facebook Fixes Email Indexing Bug

Incident-prone social network monolith Facebook has plugged yet another security leak, this time involving the indexing by search engines of email addresses not listed on Facebook. Read the full article. The Register...

Facebook 'Like-jacking' Scams Expand

Facebook attacks that force users to unwittingly endorse scam pages keep spreading, researchers say. Attacks have now circulated that cause users to recommend pages promising naked pictures of alternative rock diva Hayley Williams or the phone number of heart-throb singer Justin Bieber. Read the...

Facebook Developer Verification Won't Stop Rogue Apps

Looking to clamp down on the escalation of malicious apps on its popular social network, Facebook will now require that every developer to verify their Facebook account by providing a mobile phone number or adding a credit card to their account. While this is clearly a step in the right direction...

Facebook Hit With Clickjacking Worm

A vulnerability on Facebook forced hundreds of thousands of users to endorse a series of webpages over the holiday weekend, making the social networking site the latest venue for an attack known as clickjacking. Read the full article. The Register...

Facebook: The Money Mule Farm

Scammers and phishers are continuing to adapt their recruitment tactics, now going so far as to create special Facebook groups for their work-at-home scams. Phishers have been using social networks such as Facebook, MySpace and Twitter for years now as fertile hunting grounds not only for new...

Mozilla Firefox出错处理信息泄露漏洞

BUGTRAQ ID: 40401 Firefox是非常流行的开源WEB浏览器。 Firefox的window.onerror处理器允许读取重新定向的目标URL。如果通过HTML script标签引用了重新定向站点的话，就可以读取目标URL中所包含的会话特定查询参数。 Mozilla Firefox 3.6.3 Mozilla Firefox 3.5.9 厂商补丁： Mozilla ------- 目前厂商还没有提供补丁或者升级程序，我们建议使用此软件的用户随时关注厂商的主页以获取最新版本： http://www.mozilla.org/ XSUH Cross Site URL...

This Week In Security: Privacy, RedPhone and Adobe

In case you needed any reminders that privacy is one of the more pressing problems on the Web right now, this week’s news provided plenty of them. Along with stories of Facebook’s continued privacy missteps, this week gave us the gift of Google letting users install some Google code to opt out of...

Why Can't Johnny Have Privacy?

One of the more trite and oft-repeated maxims in the software industry goes something like this: We’re not focusing on security because our customers aren’t asking for it. They want features and functionality. When they ask for security, then we’ll worry about it. Not only is this philosophy doom...

Facebook Delete Friends Cross Site Request Forgery

Exploit Title: Facebook Delete Friends CSRF Date: 5/21/10 Author: Steven Abbagnaro Website: http://prominentsecurity.com Code: =============================================== + Facebook Delete Friends CSRF + Author: Steven Abbagnaro + Site: http://ProminentSecurity.com + Contact:...

Facebook Wall Post Joke Is a Worm

Shifty sorts have created a new worm which spread rapidly on Facebook. The malware, for now at least, does nothing more malicious than posting a message on an infected user’s Facebook wall that point to a site called fbhole.com. Nonetheless, the speed of its spread on the social networking site h...

Feasting on Twitter User Desire for Followers

The cybercriminals behind the intensifying phishing scam that has been plaguing Twitter since late last week are proving how easy it is to pervert the trust social networks like Twitter and Facebook along with search giant Google have made a cornerstone of their respective business models. The id...

Facebook Plagued By Sexiest Video Ruse

A huge attack by a rogue Facebook application last weekend infected users’ PCs with popup-spewing adware, said a researcher. Read the full article. Computerworld...

Facebook Makes Device, Identity Security Updates

Amid a controversy about privacy, Facebook unveiled new security features designed to protect user accounts. Read the full article. eWEEK...

Facebook Outs Hacker 'Kirllos'

Facebook has identified the hacker named Kirllos who tried to sell 1.5 million Facebook accounts recently in underground hacking forums. According to the investigators at the social networking site, he’s guilty of both hacking and hyperbole. Read the full article. Computerworld...

Facebook Now Trending As Phishing Target

Between January and March 2010, Facebook was the first social networking site to have made it into the list of top targets for phishing attacks. With 5.7% of all phishing attacks, Facebook took fourth place behind the traditional phishing targets PayPal, eBay and international bank HSBC, said...

Facebook, Yelp Instant Personalization Has Holes

A now-closed Facebook exploit took advantage of cross site scripting to inject malicious code into Yelp. Normally such an attack wouldn’t have particularly broad implications for Facebook users, but Yelp is one of the three sites that have been deemed fit for Facebook’s highly controversial Insta...

Facebook Photo Uploader 4 - ActiveX Control Buffer Overflow (Metasploit)

$Id: facebookextractiptc.rb 9262 2010-05-09 17:45:00Z jduck $ This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more information on licensing and terms of use...

Consumer Advocates in Facebook's Face

This week, the Electronic Privacy Information Center filed a 38-page complaint against Facebook with the Federal Trade Commission, demanding it cancel new features introduced in mid-April that compel users to share more information than before. Read the full article. Computerworld...

Facebook Now Installing Undesired Adware

Already under fire for taking liberties with users’ privacy, Facebook was outted on Thursday as a distributor of unwanted applications, some of which install adware or are added to user profiles without permission. Read the full article. The Register...