Criminals use Facebook and Tumblr to push Chrome extensions that can access all your website data

TNW - The Next Web
19 December 2012


A Facebook user by the name of Philippe Harewood on Wednesday spotted a rather interesting scam that leverages Facebook, Tumblr, and Google Chrome to spy on its victims. The privacy-violating campaign was later detailed further by security firm Webroot.

The whole campaign is based on the hopes that Facebook users want to change the theme of the site to another color, such as red. It can be of course adjusted to target other users as well.

 Harewood explains how it works. A Facebook user is invited to a fake event on the social network. He or she then clicks on a Tumblr link, which redirects to another page (typically hosted on Amazon Web Services) that prompts the user to install a Chrome extension.

The extension then executes a JavaScript file (also hosted on Amazon) when it detects an open Facebook page, which creates a new Tumblr page and a new Facebook event. Finally, the script invites all your friends and pushes the Tumblr link, and the scam starts again.

As Webroot notes, the real danger is the malicious Chrome extension, which once installed, has access to all your data on all websites, as well as access to your tabs and browsing history. The Facebook event and Tumblr links are merely used to trick users into thinking the extension will do what they want; all the URLs in question look legitimate since they are hosted on the aforementioned sites.

Here’s the page that entices users into changing their Facebook color theme:

As you can see, there’s even an accompanying EULA and privacy policy, in an attempt to further improve the scam’s legitimacy. If the user chooses not to accept the agreements, the cybercriminals behind the campaign try to monetize the hijacked Facebook traffic by asking the victims to participate in surveys full of ads to generate revenue for them anyway.

Protecting yourself is very easy: don’t click on random links on Facebook, even if they are hosted on Tumblr. Being invited to a Facebook event does not suddenly make them safe.

Sleep Positions

BBC - Reblogged from http://geneticist.tumblr.com/

Professor Chris Idzikowski, director of the Sleep Assessment and Advisory Service, has analysed six common sleeping positions - and found that each sleep position is linked to a particular personality type.

Thinker: Those who curl up in the foetus position are described as tough on the outside but sensitive at heart. They may be shy when they first meet somebody, but soon relax.

Log (15%): Lying on your side with both arms down by your side. These sleepers are easy going, social people who like being part of the in-crowd, and who are trusting of strangers. However, they may be gullible.

The yearner (13%): People who sleep on their side with both arms out in front are said to have an open nature, but can be suspicious, cynical. They are slow to make up their minds, but once they have taken a decision, they are unlikely ever to change it.

Soldier (8%): Lying on your back with both arms pinned to your sides. People who sleep in this position are generally quiet and reserved. They don’t like a fuss, but set themselves and others high standards.

Freefall (7%): Lying on your front with your hands around the pillow, and your head turned to one side. Often gregarious and brash people, but can be nervy and thin-skinned underneath, and don’t like criticism, or extreme situation

Stargazer (5%): Lying on your back with both arms up around the pillow. These sleepers make good friends because they are always ready to listen to others, and offer help when needed. They generally don’t like to be the centre of attention.