Is my computer still safe?

[once_a_banana]

Oh gurus of the current state of Mac OS and PC viruses, malware, and so on.... some advice please. Some of you may have gotten an obviously virus/spam message in your Facebook inbox from me today, with the subject "tua foto?!" and the phrase "Es este tu foto?" along with a link that may have been some variation on very sketchy or kind of legit-

Comments

[thecolorblue]

so this has nothing to do with your OS and everything to do with your browser and JavaScript. this is called a cross site scripting attack and basically what happens is when you clicked the link, you launched some JavaScript code. then that code grabbed whatever information it could from your browser cookies -- including your login info, any other login info from other sites you were still logged into OR were still stored in your browser memory (gmail, your bank, twitter, flickr, other web-based services, etc). it also grabbed all of your facebook friends' emails, which is how it was able to send emails to your friends.

once you quit the browser (and for good measure, clear your cache and cookies and whatnot), you are good, the script isn't running anymore. however, it has probably already grabbed all the info it cared about. well, probably the people who wrote this script wanted you to login to their site and give them some credit card info, but as long as they can at least propagate their attack, that's probably good enough for them. i don't think there's much else you can do, short of letting all your FB contacts know what happened and entreating them not to click any links from you.

oh and apparently since FB has applications you have to make sure you're not running any applications from this program. apparently applications can get access to your personal info if you have that setting enabled. i don't use FB so i can't really advise you on this one...

in the future, if you are suspicious about a link but you still want to open it, you can start a different browser and open the link there. for example, if you're using firefox to browse everything, open the link in safari. make sure whatever browser you do open it in is freshly started and has had its cache cleared. by the way, it is helpful to mouseover a link and not just look at the start of the URL but look at the payload as well -- the part that says "foo=bar". i'm not sure how much you know about URLs but you can actually pass quite a bit of info in them -- if you do a search on google, you'll notice that the URL actually has your query terms in it with q=search terms.

[once_a_banana]

Cool, thanks! As far as I know it hasn't done anything to my email account, and instead sent messages from my FB account to other FB users. I've done all the cache clearing and password changing now... but I worry that my FB account itself, as stored on their servers, is still infected (I did report it though, so hopefully they're also on the case).