A couple of hours ago I read a post from a friend on Facebook that said
"Secret tool shows who stalks your pics". The text was followed by a
shortened link (tweet, anyone?).
As I opened the link (in an incognito browser window of course) I was
greeted by instructions to copy some JavaScript code into my address
bar.
Hm, this smells phisy...
The JavaScript that one has to copy to the address bar crates a script
element that downloads a JavaScript file from some drop-box and executes
that JavaScript file. So the next thing I did was to download script.
Well, the script was (somewhat) obfuscated as many/most function names
were replaced with array accesses and all strings used in the code were
placed in the array as well. The array is stored as raw-hex-values. So I
decoded the values and de-obfuscated the JavaScript.
The JavaScript does the following:
- Display a nice message that it is analyzing your profile (and your
stalkers)
- Posts a (spam) message to your wall (with a random message and a link to
the tool)
- Adds you to the group "Music Makes me High." (127901437283104)
- Adds you to the group "I Hate it when I can't fall asleep because I'm
thinking." (165991450116555)
- Adds you to the event with the number 168046893242650
* I was unable to access this event - it might have been deleted
- Finds 15 of your friends and posts to a (spam) message their wall
(another random message)
- Checks all your registered entries/pages for "Facebook Insights" and
(i) adds two new admin email addresses (lethaburbach890 AT yahoo.com and
wintersaccohoqr AT hotmail.com)
(ii) writes a (spam) message to the wall of the page
- Redirects you to a page that shows some fake results and tries to get
you to fill out some "Human Verification tests".
I assume that's where they make the money.
So if you got tricked by this worm try to delete all messages, leave the
two groups that you were added into and check all your pages and remove
redundant admins!
What are the details from the code analysis:
The following functions are available:
- _88xuhyr: decrypts an array of values and executes the resulting
string as JavaScript
- addAdmin: adds a new admin to a pageid in Facebook Insights
- makePost: writes a post to a friends wall
- update: fire the Ajax request
- loading: display an image to calm the user
The original code was somewhat weird, two functions (addAdmin, makePost,
and update) were defined two times (looks like a copy-paste error before
the obfuscation)
A function (_88xuhyr) is not used in the source code. It apperas as if
they intended to obfuscate the code even further but forgot about it.
makePost has unused arguments
The following messages are used to generate spam messages:
- Wow! Seems like lots of people stalk me - http://goo.gl/lfDvG
- New FB tool shows who stalks your profile-- http://goo.gl/NHAlt
- Secret tool shows who stalks your pics http://tinyurl.com/48jd66w
- Insane! Awesome tool to see who looks at your pics http://goo.gl/3Nt6T
- According to http://ow.ly/3Zy2Z you're my top stalker. Creep.
- Secret tool shows who stalks your pics - http://goo.gl/NMclq
The possible subjects are:
- Check this out!
- Hey, whats happening?
- Hey! This is awesome
The final landing pages are:
- http://goo.gl/lfDvG -> http://thefbcreeper.info/
- http://goo.gl/NHAlt -> http://profileviewers.info/
- http://tinyurl.com/48jd66w -> http://thefbcreeper.info/
- http://goo.gl/3Nt6T -> http://profilechecker.info/
- http://ow.ly/3Zy2Z -> http://valcreepers.tk/
- http://goo.gl/NMclq -> http://profilechecker.info/
Another fun fact is, that all landing pages use the same Google
Analytics account (UA-21407597-1) for the domain .fbviews.org.
When the script finishes it redirects the user to a landing page on
fbviews.org (http://fbviews.org/result.php) that display some fake
results and tries to trick the user into entering some data.
The worm is a nice peace of JavaScript code that is somewhat obfuscated
and tries to spread on Facebook. It would be interesting to get to the
data that is stored in this Google Analytics account. According to the
pages were the users are automatically added more than 16k people have
already fallen for that trap (and counting).