I initially had assumed that a FB friend of mine was spreading a malicious link because she had innocently accepted an app and given it privileges, but she says that's not the case. See the exchange:

Friend: "Don't click on the link you got from me! It's infected! I got it from (name redacted)!!! I'm sorry! I gotta stop ****** around!"
Me: "You accepted an FB application. All you have to do is go to Account -> Privacy settings -> Apps and websites and un-accept the offending application. That's why I don't do FB apps, period."
Friend: it's not an app. not on the list...it's a worm

How does that work? JavaScript shenanigans when the person clicks on the link?

2 Answers 2


Yes, exactly JavaScript. I just met such a worm and tried to decode it.

What the actual problem is:

The recent Facebook worm works by getting users to visit a page, which makes them insert a JavaScript string into their address bar and therefore executing it.

So, DON'T EVER copy some JavaScript code into your address bar. That's the main problem. And don't click any links you don't trust. Or at least open those links in a new window using the Privacy Mode (Firefox) or Incognito mode (Chrome) so that it won't be able to access your Facebook session.

What did our hackers do to make people not realize what they're doing?

Escaping the script

The string you copy into the URL bar mostly links to another JavaScript which is executed. This script is actually decoded into entities. So instead of using string characters, the whole script was put into a string and escaped so that no human could read it in the first place.

For example, if I had a very malicious function I'd escape it and the user would only see:


and unescaped it would be

function test() { alert("LOL"); }

The script therefore unescapes "itself" before it is executed.

Obfuscating it

Now it's getting ugly: Before escaping it, the evil JavaScript code is obfuscated, with function names like _____x and variables like aLDIWEJ. This makes still sense for JavaScript, but it is entirely unreadable to humans. This is done, again, to mask the intentions of our Facebook hackers.

At this point, the code could have looked something like this:

enter image description here

What the script does

Well, what this script does is take your current Facebook session. Because you are logged into the site, it can do anything in your name. For example, things it can do through Facebook's API is:

  • creating an event like "OMG I can see who stalked me!"
  • chatting with people
  • posting status updates
  • etc.

This all happens by calling some of Facebooks API pages (some PHP pages, I forgot which).


In short... it's a virus... like any other. The method it uses to replicate itself is to make posts on your account after being executed from someone else's page. Depending on the browser and/or operating system you're using, and vulnerabilities that it has, anything is possible. Basically, once the script is running within your browser (which can start from a simple click) it in-turn uses your cached credentials to make posts on your page... which contains the same/similar link that you clicked on initially.

Short of disabling javascript/flash/and a bunch of other things (which is required by facebook) you won't be able to protect yourself from such exploits.

A quick & dirty work-around... before you click on any links in others' posts... look at where it is going. Avoid any links that end in a hash mark ("#") or have some sort of javascript reference... or do not have any actual link to it. (i.e. doesn't appear to go to any URL)

Or you could always take my approach... and avoid facebook/twitter/etc... completely. I have yet to find anything on any of those services which I would assign any value or importants to. Friends & Family know how to email... or better-still... pick up the phone. (just my opinion for what it's worth)

  • 1
    not really accurate...there are plenty of ways to protect yourself from this. You can use a plugin like NoScript, for example, to not execute the javascript. You can open the link in a new window using privacy mode/incognito mode and the new window will not have access to your facebook session. If your security is reliant on merely avoiding suspicious links, it's not very effective. If you instead use secure browsing tools correctly, you won't have to live in fear of what lurks beyond every link click. Commented May 3, 2011 at 17:37
  • @Brian Schroth: As I said in my post, "short of disabling javascript/flash/...." NoScript does exactly that. You're correct that only looking at the link's target will not save you from many exploits... Incognito mode & such will not protect you from getting a virus... and also causes problems when trying to follow links between sessions. In truth... people should live in fear of what lies beyond links. They should take a moment to think about what they're clicking on.
    – TheCompWiz
    Commented May 9, 2011 at 13:51
  • 1
    NoScript does not disable Javascript. It provides fine-grained control over what javascript does and does not execute. Your answer implies that if you "disable Javascript", you can't use Facebook anymore. But if you use NoScript, you can allow facebook.com scripts while still being protected from some random malware site's Javascript. Commented May 9, 2011 at 16:53

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.