Inius Trivia » phishing http://www.inius.ro Nothing special. Everything. Wed, 26 Oct 2011 17:45:24 +0000 en hourly 1 http://wordpress.org/?v=3.0.1 Invitation to phishing: Facebook Connect http://www.inius.ro/posts/98-invitation-to-phishing-facebook-connect.html http://www.inius.ro/posts/98-invitation-to-phishing-facebook-connect.html#comments Tue, 20 Jul 2010 19:22:55 +0000 Lucian http://www.inius.ro/?p=98 I worked these days on a “Facebook Connect” implementation. While working on it, I suddenly had a revelation: this Facebook Connect it’s an invitation to phishing!

Let’s take a look at Digg.com, a website that uses Facebook connect. When you click on the button: “Connect with Facebook”, a pop-up window like in the screen below will appear:

Problem is, that even a script kiddie can very easily emulate this pop-up window. It took me only 1/2 hours to get this button to work (click on it, works only on CSS3 browsers):

I’m wondering, how many time would need somebody really interested in phishing accounts to setup a perfect clone and start asking for “Facebook connections”? 2 hours? 3 hours?

People think that this is not so bad, as long as the phisher’s website has nothing to offer, but a smart phisher will be persuasive enough in order to make the people think that they should provide their login credentials. For example the phisher could pretend that he gives on his website the next lottery’s winning numbers.

Very, very bad for Facebook. Facebook really, really sucks with this.

]]> http://www.inius.ro/posts/98-invitation-to-phishing-facebook-connect.html/feed 0