Some time ago, an antivirus expert from our Global Research and Analysis Team, David Jacoby, discovered multiplatform malware that was distributed through Facebook Messenger. A few years ago, similar outbreaks were occurring quite often, but none have appeared lately; Facebook was doing a lot to prevent similar attacks.

 

First a preliminary report was published. At that time, Jacoby still had not had enough time to research many details about how the malware operated, but now he has, and we are ready to share them. From a user’s perspective, here’s how the infection progressed.

 

● The user received a message in Facebook Messenger from a friend. The message contained the word “Video,” the name of the sender, a random smiley, and a short link. It might look like this, for example:

 

● The link redirected to Google Drive, where the user saw something resembling a video player with a picture of the original sender in the background and what looked like a Play button.

 

● If the victim attempted to play back the “video” in Google Chrome, they were redirected to a page that looked much like a YouTube page and offered to install an extension for Chrome.

 

● If the user agreed to the installation, then the extension began to send out malicious links to their friends – and everything followed the same algorithm for each of them over again.

 

● Users of other browsers were persistently reminded to update their Adobe Flash Player instead of being offered the extension. The file they downloaded turned out to be adware – essentially, malefactors used advertisements to earn their money.

 

Jacoby, along with Frans Rosen, a researcher with whom he has been working on a project called “Hunting bugs for humanity,” have analyzed this malicious campaign and worked out how it operates.

 

The page that users were redirected to after following the link in Facebook Messenger was basically a PDF file that had been published to Google Drive. It opened as a preview. The file had a picture from a user’s Facebook page – the user whose identity was used to spread the malware – an icon for playing back the video shown over the picture, and the link that the victim opened by trying to click the playback button.

 

Clicking the link led friends of the victim to this page.
The link caused several redirections, landing the user on one of several websites. Victims using browsers other than Google Chrome ended up on a website offering to download adware masked as an update for Adobe Flash Player.

 

Browsers other than Google Chrome offered to download adware disguised as Adobe Flash Player.
In the case of Chrome, that was just the beginning: If the victim agreed to install the extension offered on the landing page, it began monitoring what websites the user opened. As soon as the victim navigated to Facebook, the extension stole their login credentials and the access token and sent them to the malefactors’ server.

A fake YouTube page offering to install Google Chrome extensions.
The crooks had found an interesting bug in Facebook. As it turned out, the unsecure Facebook Query Language (FQL), which was disabled a year ago, was not completely wiped out; it was blocked for applications, but with a few exceptions. For example, Facebook Pages Manager, an iOS application, still uses FQL. Thus, to gain access to the “locked out” feature, malware simply has to act on behalf of the application.

 

By using the stolen credentials and accessing the obsolete Facebook feature, the crooks could request that the social network send them the contact list of the victim, cull those who were not currently online, and randomly select 50 new victims from the remainder. Then, those users were bulk-messaged with a new link to Google Drive with a PDF file preview generated with the picture of the person on whose behalf the new messaging wave commenced. All in all, a vicious cycle.

 

It is worth noting that among other things, the malicious script “liked” a specific Facebook page, apparently to collect statistics for the infection. In the course of the attack, Jacoby and Rosen observed, the malefactors changed several of the specific pages, possibly as Facebook closed the previous ones. Judging by the number of “likes,” there were tens of thousands of victims.

One of the pages that infected users “liked.”
Their analysis of the code revealed that the malefactors were initially planning to use localized messages but then changed their minds and resorted to the short and simple “Video.” The localization function‘s code showed that the crooks were primarily interested in Facebook users from several European countries such as Turkey, Italy, Germany, Portugal, France (also, francophone Canada), Poland, Greece, Sweden, and all countries with English-speaking users.

 

The mutual effort of several companies has put an end to the infection’s spread for now. Nonetheless, this story is a great reminder that extensions for browsers are not as harmless as they may seem. To stay safe and not fall victim to similar malicious campaigns, avoid installing browser extensions without absolute confidence that they are safe, that they will not steal your data, and that they won’t track your online activities.

 

Also, clicking every link, even links that seem to be from someone you know, is out of the question. It is always a good idea to make sure that it is really your friend on the other end of the line, not some criminal who took control of your friend’s account.


RECOMMENDED ARTICLE FOR TECHWORLD


 
ADATA XPG SPECTRIX D80 RGB Memory Module with Liquid Nitrogen Cooling Hits 5531MHz Mark
Techworld Date Posted: 1 June 2018 10:45 AM | 798 Views
ADATA® Technology, a leading manufacturer of high-performance DRAM modules and NAND Flash products, announces that it has overclocked its XPG SPECTRIX D80 RGB DDR4 memory module to 5531MHz in a liquid-nitrogen-cooled configuration. . See More
 
ADATA XPG SPECTRIX D80 RGB Memory Module with Liquid Nitrogen Cooling Hits 5531MHz Mark
Techworld Date Posted: 10:45 AM | 798 Views
ADATA® Technology, a leading manufacturer of high-performance DRAM modules and NAND Flash products, announces that it has overclocked its XPG SPECTRIX D80 RGB DDR4 memory module to 5531MHz in a liquid-nitrogen-cooled configuration. See More

 
#RealGamingPro: Realme to Set New Standard of Smartphone Gaming with Latest Device in PH
Techworld Date Posted: 10 May 2019 11:17 AM | 15 Views
Realme Philippines is all set to take on the midrange price segment with its newest smartphone for the Philippine market, the realme 3 Pro. Scheduled for launch on May 17, the midrange champion realme.... See More
 
#RealGamingPro: Realme to Set New Standard of Smartphone Gaming with Latest Device in PH
Techworld Date Posted: 11:17 AM | 15 Views
Realme Philippines is all set to take on the midrange price segment with its newest smartphone for the Philippine market, the realme 3 Pro. Scheduled for launch on May 17, the midrange champion realme...See More

 
Industrial Networks of Energy and ICS Integration Companies Hit by More Cyberattacks than Any Other Industry in H2, 2017
Techworld Date Posted: 28 March 2018 3:32 PM | 38 Views
Almost 40% of all industrial control systems (ICS) in energy organizations protected by Kaspersky Lab solutions were attacked by malware at least once during the last six months of 2017, closely followed by 35.3%.... See More
 
Industrial Networks of Energy and ICS Integration Companies Hit by More Cyberattacks than Any Other Industry in H2, 2017
Techworld Date Posted: 3:32 PM | 38 Views
Almost 40% of all industrial control systems (ICS) in energy organizations protected by Kaspersky Lab solutions were attacked by malware at least once during the last six months of 2017, closely followed by 35.3%...See More

 
Snake Oil: In Q2 Spammers Cashed in on WannaCry Epidemics to Promote Fraudulent Services for Protection against the Notorious Ransomware Attack
Techworld Date Posted: 4 September 2017 3:30 PM | 321 Views
In Q2 2017, cybercriminals involved in spam distribution tried to capitalize on public fears when the WannaCry ransomware epidemic struck in May. Knowing that there are lots of people out there infected with this.... See More
 
Snake Oil: In Q2 Spammers Cashed in on WannaCry Epidemics to Promote Fraudulent Services for Protection against the Notorious Ransomware Attack
Techworld Date Posted: 3:30 PM | 321 Views
In Q2 2017, cybercriminals involved in spam distribution tried to capitalize on public fears when the WannaCry ransomware epidemic struck in May. Knowing that there are lots of people out there infected with this...See More

 
Kaspersky Extends Cooperation with INTERPOL in Joint Fight against Cybercrime
Techworld Date Posted: 5 July 2019 4:00 PM | 25 Views
Kaspersky Extends Cooperation with INTERPOL in Joint Fight against Cybercrime. See More
 
Kaspersky Extends Cooperation with INTERPOL in Joint Fight against Cybercrime
Techworld Date Posted: 4:00 PM | 25 Views
Kaspersky Extends Cooperation with INTERPOL in Joint Fight against CybercrimeSee More

 
HyperX Reveals Licensed Headset for PlayStation®4 at ESGS for the First Time in Philippines
Techworld Date Posted: 26 October 2018 4:15 PM | 20 Views
HyperX, the gaming division of Kingston Technology, joins ESGS at the SMX Convention Center, Pasay City in Philippines from October 26th to 28th.. See More
 
HyperX Reveals Licensed Headset for PlayStation®4 at ESGS for the First Time in Philippines
Techworld Date Posted: 4:15 PM | 20 Views
HyperX, the gaming division of Kingston Technology, joins ESGS at the SMX Convention Center, Pasay City in Philippines from October 26th to 28th.See More

Rhea Sanvictores
Edifier Unveils First Concept Store in PH
Techworld • By: Rhea Sanvictores | Date Posted: 7 December 2018 3:53 PM | 241 Views
Premium audio solutions corporation Edifier has gone the extra mile in showcasing technological innovation and design elegance with the opening of its pioneer concept store in the Philippines. . See More
Rhea Sanvictores
Edifier Unveils First Concept Store in PH
Techworld • By: Rhea Sanvictores | Date Posted: 3:53 PM | 241 Views
Premium audio solutions corporation Edifier has gone the extra mile in showcasing technological innovation and design elegance with the opening of its pioneer concept store in the Philippines. See More

 
Streaming Movie Baywatch (2017)
Techworld Date Posted: 16 September 2017 9:37 AM | 28 Views
Fast-paced, on-the-go, and with a crucial priority for high-speed connectivity, the world today has increasingly higher and higher demands for the best Internet performance-and your Small Office/Home Office (SOHO) environment is no exception. Powered.... See More
 
Streaming Movie Baywatch (2017)
Techworld Date Posted: 9:37 AM | 28 Views
Fast-paced, on-the-go, and with a crucial priority for high-speed connectivity, the world today has increasingly higher and higher demands for the best Internet performance-and your Small Office/Home Office (SOHO) environment is no exception. Powered...See More

 
From Shaking Their Hands to Paying off Their Debts: Third party Cybersecurity Failures Cost Businesses the Most
Techworld Date Posted: 25 September 2017 11:26 AM | 334 Views
While more companies are investing in cybersecurity regardless of ROI (63% in 2017 compared to 56% in 2016), a new study from Kaspersky Lab and B2B International has found that the average cost of.... See More
 
From Shaking Their Hands to Paying off Their Debts: Third party Cybersecurity Failures Cost Businesses the Most
Techworld Date Posted: 11:26 AM | 334 Views
While more companies are investing in cybersecurity regardless of ROI (63% in 2017 compared to 56% in 2016), a new study from Kaspersky Lab and B2B International has found that the average cost of...See More

 
UBTECH Announces Arrival of Star Wars First Order Stormtrooper Robot with Companion App
Techworld Date Posted: 9 January 2018 4:50 PM | 28 Views
UBTECH Robotics, a global leader in intelligent humanoid robots, today announced its latest offering, the Star Wars First Order Stormtrooper Robot by UBTECH, is now available in retail stores and online.. See More
 
UBTECH Announces Arrival of Star Wars First Order Stormtrooper Robot with Companion App
Techworld Date Posted: 4:50 PM | 28 Views
UBTECH Robotics, a global leader in intelligent humanoid robots, today announced its latest offering, the Star Wars First Order Stormtrooper Robot by UBTECH, is now available in retail stores and online.See More


Power by

Download Free AZ | Free Wordpress Themes