Cross-browser worm spreads via Facebook, security experts warn

[WhoIsNumberNone]

From Computer World:

Malware writers use Crossrider browser extension development framework to build Facebook worm

IDG News Service - Malware writers have used Crossrider, a cross-browser extension development framework, to build a click-fraud worm that spreads on Facebook, security researchers from antivirus firm Kaspersky Lab said on Monday.

Crossrider is a legitimate Javascript framework that implements a unified API (application programming interface) for building Mozilla Firefox, Google Chrome and Internet Explorer extensions.

The API allows developers to write code that will run inside different browsers and, by extension, on different OSes. The framework is still in beta testing and its creators plan on adding support for Safari soon.

<SNIP>

In order to spread, the malware leverages its control over infected browsers to piggyback on active Facebook sessions and send spam messages on behalf of authenticated Facebook users.

The links included in LilyJade's Facebook spam messages direct users to compromised websites that load the Nuclear Pack exploit kit into a hidden iframe, Golovanov said.

[Sheepshank]

1. wow

but does it do windows?

...
.
.
.
.
.
get it...windows?
.
.
.
.
.
.


My silly.....I'm tech illiterate, and everything except "and, but and on" in this article are wasted on me.

[WhoIsNumberNone]

2. OK- the short version

If you get any weird messages from your Facebook friends, don't click on the links.

[Gman]

3. +1

[pnwest]

4. thank you!

[Sheepshank]

6. I can get behind that...thanks :) n/t

[Egalitarian Thug]

5. It's really too bad that we have companies too big to adhere to protocols.

This is what happens when there are no rules and the worst of the worst are given too much power.