Came across a few interesting posts like this on my wall today.

All posts pointed to links of the form “ https://dalefrases.com/chicasexy/ver- RANDOM-DIGITS.html”

The page appears to be a naive “spammy” video page but has three like buttons hidden underneath the video by setting their opacity to zero. It should be noted that it is tough if not impossible to prevent a clickjacking attack for the “like” button [unlike in case of the “share” button where a user is first redirected to Facebook].

But the interesting aspect about this attack is that the prankster (or spammer?) probably understood that Facebook is monitoring viral URLs and any spammy viral URL will get caught, therefore, the prankster decided to generate URL patterns instead of URLs and as of now, it seems that the technique has worked for him/her.

Note: If this post appears on your wall, don’t panic and just delete it, this is just a clickjacking/like-jacking, the prankster won’t get your account credentials/any other information from your account. For a related Facebook attack that does go after credentials via a phishing page, see Preliminary analysis of Facebook clickjacking - aprilfoolsprank, and for a self-propagating Facebook worm, see Analysis of Facebook Rotating Images worm.

This is my personal blog. The views expressed on these pages are mine alone and not those of my employer.