Facebook phishing flap

Jake Widman
Saturday, 16 May 2009 02:24

Business IT - Security

Over the past couple of days, many Facebook users were successfully targeted by a phishing scam to obtain their logins and passwords.

Operating from already-hacked accounts on the popular social networking site, the phishers sent messages to the accounts' friends, urging them to visit a website.

Once there, the targets saw a page that looked just like the Facebook login page. Entering their logins and passwords unwittingly passed that information along to the scammers.

The phishing website used one of several URLs ending in the .im domain, such as www.151.im and www.123.im.

References to those domains have been deleted from Facebook, and the compromised accounts were being blocked until the damage was cleaned up. The site is also resetting the passwords of affected members.

The number of Facebook users affected is unknown, but a spokesperson told the New York Times that "is not widespread and is only impacting a small fraction of a percent of users."

However, two of this writer's 74 friends were among those whose accounts were hacked --  not a large number proportion, to be sure, but a lot more than "a small fraction of a percent."