Sign in with
Sign up | Sign in

Facebook Scam Tricks Users Into Hacking Themselves

By - Source: Tom's Guide US | B 4 comments

Many security experts are fond of saying that humans are the weak link in any security system. Scams like this one prove them right.

The latest Facebook scam promises to give people the ability to hack into anyone's account. But follow the instructions and you'll only end up hacking your own page, via a trick called Self-XSS, thus making yourself vulnerable to new scam campaigns. Well, don't dish it out if you can't take it, right?

MORE: Best PC Antivirus Software 2014

The scam appears as either an email or a Facebook post on your Timeline purportedly from a friend of the victim. "Hack any Facebook account following three steps," the scam promises. It then instructs readers to open Facebook in a web browser and go to the Facebook page of the person they want to hack. Then right-click anywhere on the page and from the popup menu select Inspect Element. This brings up an HTML editor at the bottom half of your Web browser.

In this editor, the scam instructs readers to copy-paste a string of code. But, unsurprisingly, the code does not do what the scammers claim it does. Rather, this code grants the scammers access to your own account. 

This kind of hack is called cross-site scripting, or XSS, because it involves compromising a Web page by injecting a script (a short piece of code) that then affects that site's integrity. XSS is considered a vulnerability, and is probably something that the browser should fix, not Facebook.

Meanwhile, Facebook has added Self-XSS to its list of Security Threats, with a warning not to paste any strange code into browsers. But Facebook hasn't announced any plans to patch any part of its code that makes this attack possible.

Once the scammers are in control of your account, they can use your account to post more of these fake instructions, or launch even more cyberscams. They may also have access to your email and password, so if you use the same login credentials at any other Web service you'll want to change them immediately.

If you see this kind of spam on Facebook, you should flag it as such by clicking the arrow in the upper-right corner of the post and selecting "This is Spam." If you fell for this scam, you should contact Facebook immediately. You may also want to change your password, but it's likely the scammer doesn't need your password to compromise your account, since presumably you executed the script while you were already logged into Facebook.

Jill Scharr is a staff writer for Tom's Guide. You can follow her on Twitter @JillScharr and on Google+.  Follow us @TomsGuide, on Facebook and on Google+.

Discuss
Ask a Category Expert

Create a new thread in the Streaming Video & TVs forum about this subject

Example: Notebook, Android, SSD hard drive

This thread is closed for comments
  • 3 Hide
    Avus , July 28, 2014 9:45 AM
    i hope more of this scam are available for evil but stupid/retarded users.
  • 1 Hide
    dstarr3 , July 28, 2014 9:55 AM
    You would think that the people that are just shit at using the internet would get frustrated by all the attacks and stop. But they just keep coming back for more.
  • 0 Hide
    virtualban , July 29, 2014 12:59 AM
    If users need to paste a code they get from their facebook, what's to stop it from not needing the user at all and just getting the code directly? Cookie or some other method.
  • Display all 4 comments.
  • 0 Hide
    cats_Paw , July 29, 2014 2:12 AM
    Talking about Karma....
Tom’s guide in the world
  • Germany
  • France
  • Italy
  • Ireland
  • UK
Follow Tom’s guide
Subscribe to our newsletter
  • add to twitter
  • add to facebook
  • ajouter un flux RSS