- Jun 9, 2013
- 6,720
Cyberattackers are using access tokens for legitimate Facebook apps as vehicles to spread spam on the apps' behalf. How do they do it? By tricking Facebook users into handing over their tokens in exchange for "likes," comments, friends, and followers.
Researchers at Proofpoint discovered an API access token for a verified Facebook app was being used to fuel comment spam on other Facebook pages. In this case, the victim page belonged to a major media outlet and Proofpoint customer.
Comment spam both interferes with social media interactions and exposes users to phishing and malware. A lot of comment spam found on social channels is generated by botnets, as was the case here.
In this case, spammers used the official HTC Sense app to trick users by leveraging an outdated version of the app and an earlier version of the Facebook API. How it worked:
Spam comments on the company's page referred to websites containing instructions for installing a particular version of the HTC Sense Facebook app. Users clicked the links and installed the app. They were shown how to get a developer-level API access token for the HTC Sense app.
Read More. Facebook Spam Botnet Promises 'Likes' for Access Tokens
Researchers at Proofpoint discovered an API access token for a verified Facebook app was being used to fuel comment spam on other Facebook pages. In this case, the victim page belonged to a major media outlet and Proofpoint customer.
Comment spam both interferes with social media interactions and exposes users to phishing and malware. A lot of comment spam found on social channels is generated by botnets, as was the case here.
In this case, spammers used the official HTC Sense app to trick users by leveraging an outdated version of the app and an earlier version of the Facebook API. How it worked:
Spam comments on the company's page referred to websites containing instructions for installing a particular version of the HTC Sense Facebook app. Users clicked the links and installed the app. They were shown how to get a developer-level API access token for the HTC Sense app.
Read More. Facebook Spam Botnet Promises 'Likes' for Access Tokens
