1

Today, I received a mail from fb saying that two of my friends have mentioned me in a comment. When I opened fb to see that comment, it was filled with random names (which obviously were their friends/friend-of-friends) and mine was one of them.

And the topic of the comment was an advertisement proclaiming a hack to reveal any fb user's username and password. It then gave a bunch of instructions asking you to visit the user's page, opening the browser web-console and pasting some code there. It claimed that doing so would reveal the said user's fb username and password (which is obviously absurd).

fb username of this topic poster was Beauty.20000. But whats going on here? Is this an attempt at social engineering (as I suspect) ?

Improve this question
9
  • Its a hack that you do and when you do it it tags all your friends
    – Sahil
    May 26, 2014 at 12:36
  • It's definitely some sort of social-engineering attack, yes. You're doing XSS to yourself... We'd need to see the code to know exactly what it would do, but I can guess that 1) It can likely trivially retrieve your username (not a terribly big deal, on its own), and 2) no, it's unlikely to be able to just grab your password, so long as you don't enter it again. It's possible that the given code has methods to persist over changes in the Facebook JavaScript code, so a simple logout may not be safe (you'd need to clear the browser cache).
    – Clockwork-Muse
    May 26, 2014 at 12:41
  • @Clockwork-Muse - I haven't done any XSS to myself, but looks like two of my friends have. Here is the code link which the poster provided: textuploader.com/rwf2/raw
    – Prahlad Yeri
    May 26, 2014 at 12:44
  • Yeah, somebody's up to something, that's obfuscated. I don't know enough to proceed easily myself, curious if somebody else here will do the honors.
    – Clockwork-Muse
    May 26, 2014 at 12:47
  • 1
    forgot 100000821542260 @PrahladYeri : obfuscation helps a lot in SE! But here you are right, if the user does follow the instructions, he is dumb enough to do anything he's told... PS: see the number of followers/likes on the 100000066374374 profile. Haha. There goes the answer i guess.
    – zX8iqV
    May 26, 2014 at 13:35

2 Answers 2

Reset to default
1

it certainly is. you might want to google "Phishing".

edit: i'm curious, what code did they ask to paste in the web console?

Improve this answer
1
  • Updated the link to code in the comments.
    – Prahlad Yeri
    May 26, 2014 at 12:45
2

Yes, this is known as "self-XSS" or "self cross-site scripting".

Some websites now show a warning in the console:

Any code you paste here can be executed on the current page. If you're logged into Facebook, whoever wrote the code that you paste has full control over the current page.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .