Facebook Scam Tricks Users Into Hacking Themselves

News
By published

People trying to hack others' Facebook accounts ended up being hacked themselves, thanks to a new scam.

Many security experts are fond of saying that humans are the weak link in any security system. Scams like this one prove them right.

MORE: Best PC Antivirus Software 2014

The scam appears as either an email or a Facebook post on your Timeline purportedly from a friend of the victim. "Hack any Facebook account following three steps," the scam promises. It then instructs readers to open Facebook in a web browser and go to the Facebook page of the person they want to hack. Then right-click anywhere on the page and from the popup menu select Inspect Element. This brings up an HTML editor at the bottom half of your Web browser.

In this editor, the scam instructs readers to copy-paste a string of code. But, unsurprisingly, the code does not do what the scammers claim it does. Rather, this code grants the scammers access to your own account. 

This kind of hack is called cross-site scripting, or XSS, because it involves compromising a Web page by injecting a script (a short piece of code) that then affects that site's integrity. XSS is considered a vulnerability, and is probably something that the browser should fix, not Facebook.

Meanwhile, Facebook has added Self-XSS to its list of Security Threats, with a warning not to paste any strange code into browsers. But Facebook hasn't announced any plans to patch any part of its code that makes this attack possible.

Once the scammers are in control of your account, they can use your account to post more of these fake instructions, or launch even more cyberscams. They may also have access to your email and password, so if you use the same login credentials at any other Web service you'll want to change them immediately.

If you see this kind of spam on Facebook, you should flag it as such by clicking the arrow in the upper-right corner of the post and selecting "This is Spam." If you fell for this scam, you should contact Facebook immediately. You may also want to change your password, but it's likely the scammer doesn't need your password to compromise your account, since presumably you executed the script while you were already logged into Facebook.

Jill Scharr is a staff writer for Tom's Guide. You can follow her on Twitter @JillScharr and on Google+.  Follow us @TomsGuide, on Facebook and on Google+.

TOPICS
Jill Scharr

Jill Scharr is a creative writer and narrative designer in the videogame industry. She's currently Project Lead Writer at the games studio Harebrained Schemes, and has also worked at Bungie. Prior to that she worked as a Staff Writer for Tom's Guide, covering video games, online security, 3D printing and tech innovation among many subjects. 

4 Comments Comment from the forums
  • Avus
    i hope more of this scam are available for evil but stupid/retarded users.
    Reply
  • dstarr3
    You would think that the people that are just shit at using the internet would get frustrated by all the attacks and stop. But they just keep coming back for more.
    Reply
  • virtualban
    If users need to paste a code they get from their facebook, what's to stop it from not needing the user at all and just getting the code directly? Cookie or some other method.
    Reply
  • cats_Paw
    Talking about Karma....
    Reply