According to a survey by Sophos, 95% polled users comment that Facebook is doing enough to stop clickjacking worms on Facebook.
The attacks, dubbed 'likejacking' by Sophos, exploit the 'Like' button facility by automatically updating a user's Facebook page to say that they 'like' a third-party webpage. This update is automatically shared with a user's Facebook friends via the website's newsfeed, helping the attacks to spread rapidly across the social network.
"Facebook clearly hasn't been security conscious enough in the implementation of its social 'like' plugin. This leaves the system open to abuse by spammers and scammers, and exposes users to the risk of outside threats," said Graham Cluley, Senior Technology Consultant at Sophos. "One solution would be for Facebook to implement ways for members to make a more conscious decision as to whether they want to 'Like' third party content or not. By having a pop-up box asking whether users are sure they want to 'Like' a particular page, or offering the option to disable the third-party 'Like' feature entirely, the spread of these attacks would be much easier to control."
Although the attacks are yet to deliver malicious payloads, they demonstrate an exploitable weakness in the way that Facebook works, putting users at potential risk from further malware or phishing attacks.
