While Facebook has been busy working on its new constitution in an effort to appease its increasingly anxious community over the past few days, the second application of dubious intent made its way onto the troubled site in the space of a week. The bad guys, it seems, have perfect timing.
Trend Micro reported Thursday that a rogue Facebook application had been posting false notifications to user profiles, telling them they have violated Facebook’s Terms of Service and directing them to a malicious site for more information.
The alert read: “[Friend’s name] has just reported you to Facebook for violating our Terms of Service. This is your official warning! Click here to find out why you were reported! Request Facebook look at what has happened and rule immediately.”
Users who followed the link were directed to another application which, when installed would proceed to spam the affected user’s friends with the same notice, all the while gathering personal information.
This was the second scam for Facebook this week, following the ‘Error Check System‘ app that sent notifications to users informing them that friends had encountered errors when trying to access their profile and providing a malicious link to view the error message.
While the Trend Micro report advised users to “exercise extreme caution when surfing,” and that Facebook review its application hosting policy, Graham Cluley points to the real culprit: Facebook itself.
“Third-party applications are not vetted before they are made available to the public. So, even as Facebook stamps out one malignant application, it can pop up in another place like a poisoned mushroom with a different name.”
Although we’re excited about the prospect of increased openness at Facebook, and impressed by the speed with which Mark Zuckerberg promised to bring democracy to Facebook after last week’s user revolt, we can only hope that the giant Facebook gives some serious attention to the way it accepts third party apps – and soon. Having a bad month is one thing; having a bad year is quite another.
Image credit: Trend Micro
