23rd May 2009
How To Stay Safe from the Current Phishing & Trojan Scams on Facebook (& Anywhere Else)
This week there have been two phishing scams on Facebook, which are especially destructive as they contain trojans that can steal information from compromised computers. Here is how to stay safe, help others do likewise and help keep the attack from spreading.
How it Works
The attackers are using what is known as “drive-by download” It is especially malicious as it steals the member’s information (whether the member gives it or not) changes their password and then sends the same message—masquerading as being from the member to the user’s friends.
It seems that in the newest scam the phishers have both facebook account info and also regular email info, possibly harvested from the past attack. Plus, since the Trojan is spyware they may have more info from compromised PCs. This means the phishing could come from other Facebook, other social media suites and also arrive as real email.
The scam sends a member an innocent looking Facebook email that says Hello or something that seems innocent. Inside the body of the message is a link that ends with .at (dot at). This link takes the member to a page that seems to be a regular sign in Facebook page – like the one used for Facebook apps. It asks for the member’s email and password.
One of the links used is “areps.at”. Do not click on it or any link that ends with an .at as more than one is in use.
As soon as it has this information it changes the password and begins to send out similar messages to the member’s friends.
What You Need To Do
Be alert! Do not follow any links you receive from anyone—even your mom, mate or best buddies—if there is a “at” at the end of that link This includes if the link comes through your Facebook email, on a FB Wall, in your regular email, you see it in the stream of a social media site such as Twitter, Tumblr, etc.
-
Use Mozilla Firefox as your browser. Apparently it blocks these addresses. Mozilla has a history of preventing worm attacks and such. It its twitter users safe during the Mikey attacks.
-
Share this link and the info with all of your friends and even followers. It will help them. It will also help you because if they are not infected it is far less likely that your PC will be.
-
Only use known and respected Facebook or social media apps. ALWAYS be careful where you five your sign in info and password.
-
Make sure you use different passwords for all your social media accounts.
-
IMPORTANT: If you think your PC has been compromised immediately use a friends PC to log into any banking, credit card or important accounts and change all passwords and user names. The trojan being used can get information from a PC and this is the prime info phishers are after.
-
Always keep your PC virus and spyware protection up to date [Note: this will not always protect you from the newest viruses. It will not protect you if you enter your info to any phishing site].
-
If you receive an email with a link that ends in at, but are smart and do not click on it your PC is still safe. Cut and paste the sending member’s name and message it to the site’s customer service. You are not tattling on a friend, only phishers. This will help your friend have their account restored and protect others.
I Received the First Facebook Phishing Message
I received the first one, artep.at , but since I did not recognize the friend and there was nothing except a suggestion I click on the link to give me an idea, I was not enticed as I am too busy to willy nilly click on every link.
Facebook has handled the first problem. That email in my in box disappeared. Those links have been blocked.
I do not know if all the Facebook user accounts that were compromised are now restored and what damage has been done.
Next—Continuing updates:
Continue to check back to this site as I will update with new information.
Follow me on Twitter @judyrey as I will announce when this blog article is updated. I will aso post a link to this article and announce updates on my public fan page, Judy Rey Wasserman. [and while you're there become my fan. I'm the artist Judy Rey Wasserman. I'm fouunding Post Conceptual Art, especially the branch known as UnGraven Image.]
The person who brought this information to my attention is Stephen Hultquist who is a member and friend on Facebook and we follow each other on twitter where he is @shultquist.
I found good information on these attacks at http://www.infopackets.com and http://mashable.com/2009/05/21/arepsat/
Leave a Reply