I joined FaceBook roughly 1 year ago, and I have truly enjoyed the experience. I have connected with many old friends and relatives. Without FaceBook none of this would be possible, and hence my life is a little richer. But, and this is a big but, Facebook is evolving into a dangerous place.
Let me give an actual example of how one can be tricked into downloading badware when on Facebook. First, I would like to introduce an old friend of mine, Duffy Conway. Duffy worked at Gateway in sales, and was consistently one of the company’s top producers. I left Gateway over 10 years ago, and I was delighted to have Duffy as my friend on Facebook.
One day, I got a note from Duffy in my Facebook mail. See the shot below. Almost immediately, warning bells were going off in my head. Duffy is not the chatty type unless it is about football or Bill’s Bar in Sioux City Iowa, so it was quite a surprise to get a mail about a video that he made of me. Here are the four warning signs from this Facebook mail.
- n.ew vid.eo is misspelled in a very unusual way.
- Duffy sent this mail to a long list of people. Many of whom I do not know. Could there really be video with me and a bunch of strangers?
- Duffy is not the home video sort of guy.
- The mail goes to a strange URL that I am not familiar.
Duffy’s Facebook mail had 4 signs that this was a scam.
Something really smelled about this. Just out of curiosity, I decided to click on the link for Duffy’s “video”.
I clicked on the link because you cannot get badware by just clicking on a link. There is only one way to get badware and that is by downloading and executing software. A link by itself is harmless, although it is clear in this case that I would be going to a bad and dangerous place. I was discussing this article with a friend, and he was surprised. He was under the impression that badware could mysteriously install all by itself. This is not true. You must actively invite badware on your system, through program execution.
After I clicked on the link, I found myself on a very different web site. The IE security bar immediately warns me that a file wants to be downloaded. If warning bells were not going off, they should be blaring by now. It is clear that this site would have me believe that I must download and execute a file to watch this video from my pal, Duffy.
I have modified the actual screen shot to show 5 signs why this is a bad web site and should not be trusted.
- The name YouTube (YuoTube) was misspelled.
- The address did not have a name but a series of letters.
- The YouTube logo is missing.
- The IE security warning is displayed.
- A phony download message is displayed.
Despite the five warning signs, people actually download the badware.
The problem is that people fall for this stuff. Even if you are running security software, if you force IE to run this badware, odds are that the security software won’t catch it. There are so many warning signs but people just want to believe that their long lost friend has a cool video of times gone by.
So get this. I was talking to one of our employees at PC Pitstop about this article, and his wife fell into this exact same trap. Worse yet, he spent the better part of a weekend cleaning it up.
In summary, the most effective security software is the software inside of your own head. We all must learn the key signs of how badware gets installed on our computers. Because Facebook is all about your friends, there is tendency to let down your guard, when in fact the opposite is true.
