Facebook not secure enough: Sophos Poll

The attacks, dubbed 'likejacking' by Sophos, exploit the 'Like' button facility by automatically updating a user's Facebook page to say that they 'like' a third-party webpage. This update is automatically shared with a user's Facebook friends via the website's newsfeed, helping the attacks to spread rapidly across the social network.

The latest widespread attack struck Facebook users, tricking them into 'liking' a webpage entitled '101 Hottest Women in the World' with a picture of Jessica Alba. Sophos conducted a poll of 600

internet users asking: "Do you think Facebook is doing enough to stop clickjacking worms?" Of those

polled, 95% voted no, emphasizing the urgent need for Facebook to fix the problem.

Although the attacks are yet to deliver malicious payloads, they demonstrate an exploitable weakness in

the way that Facebook works, putting users at potential risk from further malware or phishing attacks.

"Facebook clearly hasn't been security conscious enough in the implementation of its social 'like'

plugin. This leaves the system open to abuse by spammers and scammers, and exposes users to the risk of

outside threats," said Graham Cluley, Senior Technology Consultant at Sophos.