Widespread Facebook application installs adware Secret Crush leads to unwanted advertising

[news release] IT security and control firm Sophos has warned users of the popular Facebook social-networking site to exercise care over which applications they install following the discovery of a “Secret Crush” app that downloads adware onto their PC.The Secret Crush application, which at the time of writing has over 50,000 daily users on Facebook, invites people to find out who amongst their friends has a secret crush on them. Users tempted to discover more have to invite at least five other Facebook users to install the application before their mystery admirer is revealed.However, no secret crush is ever revealed. Instead users are directed to an external website which invites Facebook users to download potentially unwanted applications that will display pop-up advertising.”Whoever wrote this Secret Crush application is cashing-in big time, by encouraging people to download the adware. As an affiliate for the people displaying the nuisance pop-up adverts, they are getting paid for each successful installation,” said Graham Cluley, senior technology consultant for Sophos. “Facebook users must show greater discretion about how they use the site, and which applications they install. These third party widgets are not written by Facebook, and can mean that you are carelessly sharing your personal information with strangers or risking your computer’s security.”Sophos experts believe that companies need to set policies regarding Facebook usage, and implement web security solutions, to prevent dangers entering the workplace.”Companies need to make their own mind up as to whether they want to allow their users to access websites like Facebook and MySpace during office hours. If workers are allowed to be given access to these sites then it’s vital that they do not put their personal and corporate data at risk,” explained Cluley. “If your users are installing third party Facebook applications in the office they could potentially be bringing adware, spyware and malware into your organization at the same time. The best defense is for businesses to defend themselves with a web security and control appliance which can filter internet access and prevent the downloading of malicious code.”Sophos notes that although Facebook appears to have removed Secret Crush from its search results, it is still possible at the time of writing to install the offending application.”Facebook has thousands of third party applications available on its site for members to install, and it’s obviously proving impossible for them to police them all,” continued Cluley. “The message from Facebook to its users appears to be ‘add third party applications at your own risk’.”Last year, Sophos published research showing that 41 percent of Facebook users were prepared to divulge personal information to a complete stranger (a small plastic frog called Freddi Staur – an anagram of ‘ID Fraudster’).
http://sophos.com/pressoffice/news/articles/2008/01/facebook-adware.htmlSophos urges caution on Facebook apps
Facebook users have been advised to exercise caution before downloading applications on the social-networking site, after an application was identified as downloading adware onto users’ PCs.
http://news.zdnet.co.uk/security/0,1000000189,39291981,00.htm

Leave a Reply

Your email address will not be published.

This site uses Akismet to reduce spam. Learn how your comment data is processed.