Facebook, A Worm’s Best Friend?

Just when you thought it was safe to go back into Facebook, the Koobface worm returns. Version 28 (and you thought rabbits were prolific) of the worm spreads via a message from a Facebook friend that includes a link to what looks like a video.

After being downloaded on a PC, the worm will send information to a remote server. The information sent may contain log in information which then allows an attacker to impersonate a legitimate Facebook user. To complete the cycle, the worm will then sent similar messages to the friends of the infected user.

Facebook has been hit by several rouge applications and worms recently, prompting some security experts to quip that as an attack platform, it has come of age. All this in spite of an application verification service which validates Facebook apps. Unfortunately the service is voluntary. I'm all for freedom of expression on the web, but if you are going to let someone install an application that runs on your platform...shouldn't you make sure it is not malicious?