1

Today, I received a mail from fb saying that two of my friends have mentioned me in a comment. When I opened fb to see that comment, it was filled with random names (which obviously were their friends/friend-of-friends) and mine was one of them.

And the topic of the comment was an advertisement proclaiming a hack to reveal any fb user's username and password. It then gave a bunch of instructions asking you to visit the user's page, opening the browser web-console and pasting some code there. It claimed that doing so would reveal the said user's fb username and password (which is obviously absurd).

fb username of this topic poster was Beauty.20000. But whats going on here? Is this an attempt at social engineering (as I suspect) ?

  • Its a hack that you do and when you do it it tags all your friends – Sahil May 26 '14 at 12:36
  • It's definitely some sort of social-engineering attack, yes. You're doing XSS to yourself... We'd need to see the code to know exactly what it would do, but I can guess that 1) It can likely trivially retrieve your username (not a terribly big deal, on its own), and 2) no, it's unlikely to be able to just grab your password, so long as you don't enter it again. It's possible that the given code has methods to persist over changes in the Facebook JavaScript code, so a simple logout may not be safe (you'd need to clear the browser cache). – Clockwork-Muse May 26 '14 at 12:41
  • @Clockwork-Muse - I haven't done any XSS to myself, but looks like two of my friends have. Here is the code link which the poster provided: textuploader.com/rwf2/raw – Prahlad Yeri May 26 '14 at 12:44
  • Yeah, somebody's up to something, that's obfuscated. I don't know enough to proceed easily myself, curious if somebody else here will do the honors. – Clockwork-Muse May 26 '14 at 12:47
  • 1
    forgot 100000821542260 @PrahladYeri : obfuscation helps a lot in SE! But here you are right, if the user does follow the instructions, he is dumb enough to do anything he's told... PS: see the number of followers/likes on the 100000066374374 profile. Haha. There goes the answer i guess. – zX8iqV May 26 '14 at 13:35
1

it certainly is. you might want to google "Phishing".

edit: i'm curious, what code did they ask to paste in the web console?

  • Updated the link to code in the comments. – Prahlad Yeri May 26 '14 at 12:45
2

Yes, this is known as "self-XSS" or "self cross-site scripting".

Some websites now show a warning in the console:

Any code you paste here can be executed on the current page. If you're logged into Facebook, whoever wrote the code that you paste has full control over the current page.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.