Facebook said on Wednesday that it has stopped most of the spam that has flooded many users’ pages with pictures showing graphic sex and violence, amongst other things. According to Facebook’s statement the people behind the attack are exploiting a browser vulnerability that allows “self-XSS”. XSS is shorthand for cross-site scripting, which allows an attacker to execute JavaScript code in the user’s browser that can access and control the website you are interacting with.
“During this spam attack users were tricked into pasting and executing malicious javascript in their browser URL bar causing them to unknowingly share this offensive content. Our engineers have been working diligently on this self-XSS vulnerability in the browser. We’ve built enforcement mechanisms to quickly shut down the malicious Pages and accounts that attempt to exploit it. We have also been putting those affected through educational checkpoints so they know how to protect themselves. We’ve put in place back-end measures to reduce the rate of these attacks and will continue to iterate on our defenses to find new ways to protect people.”
Facebook also urged its 800 million-plus users to remain vigilant to keep their accounts from being hijacked. Word to the wise: use your common sense and do not fall for too-good-to-be true scams.
