A spammer has exploited a serious vulnerability in Facebook's photo upload system to spam both Facebook and Twitter with photos promising "free" iPads and iPhones.
The photos, which were posted to peoples' walls by exploiting a flaw in which it was not checked whether a photo could be posted to someone's profile, pretended to be from the profile owner and promoted schemes promising cheap or free gadgets - particularly iPhones and iPads.
Among those affected were a friend of Facebook chief executive Mark Zuckerberg - who responded, says the security company Sophos; Zuckerberg responded to the picture by asking his friend "Is this real or did your account get hacked?"
Robert McMillan for IDG was the first with the detail, which he says let the spammer post "thousands" of messages on peoples' Walls.
People who saw the fake postings appear on their Wall, and knew they hadn't put them there, would assume it was their own account which had been hacked and change their password - but this made no difference, because the flaw is in Facebook's basic photo authentication code.
As the company told McMillan, "Earlier this week, we discovered a bug in the code that processes photos as they're uploaded. This bug caused us not to make the correct checks when determining whether a photo should be posted to a person's profile... We quickly worked to resolve the issue and fixed it shortly after discovering it. For a short period of time before it was fixed, a single spammer was able to post photos to people's profiles that they hadn't approved."
It remains to be seen whether that's the last of the problem. Meanwhile, Twitter users have had their own problems: property doyenne Kirstie Allsopp was among a number of people whose accounts were hacked at the weekend to send out (yet more) "free iPad" and "OMG free iPhone" tweets.
Sophos notes that Allsopp has since removed the offending tweets, which would have led anyone who followed them to webpages where they were encouraged to apply for "free" iPads in exchange for personal information and sign up for scams that charged £4.50 per week.
"Interestingly, the spam messages were sent 'via web', suggesting that it wasn't a third party application or linked website that was used to send the messages," said Graham Cluley, senior technology consultant, Sophos. "It seems likely that Kirstie Allsopp's Twitter password was stolen via a phishing or spyware infection on her computer, or that she was using the same password on multiple websites – which is never a good idea."
Allsopp isn't pleased: "Hacking is a pain in the bum" she observed pithily after changing her password, profile picture and deleting the offending tweets. Yup - which only makes the case for better passwords stronger.
Comments (…)
Sign in or create your Guardian account to join the discussion