And NO, Starbucks isn’t giving away free vouchers on Facebook
1. Via a Webpage
“Likejacking” is a Facebook-specific version of an attack called “clickjacking.” The purpose of the attack is to get you to click items on a webpage without your knowledge.
Facebook attackers present a web page that actually has two layers. The back layer is designed with a Facebook “Like” button configured to follow your mouse cursor. The front layer shows whichever lure you are unfortunate enough to be tricked by. No matter where you click on the webpage, whether it be “One of the craziest ways to eat a banana” or “101 Hottest Women in the World,” you are actually clicking the Facebook Like button and further spreading the spam.
The earliest instances of likejacking seemed to be a proof of concept that the attack would actually work. Since those first attacks, likejacking has evolved into a money-making scheme through a technique called affiliate marketing. Affiliate marketing pays the affiliate for every person who views an ad, signs up for a service or registers on a given site. We have yet to see these attacks lead to malicious content, but it is only matter of time until they do.
One reason this attack works is that Facebook does not require any confirmation when you click the Like button. Though confirmation would not entirely prevent the attack, it would complicate the attack and potentially discourage its active exploitation.
Users should carefully review their wall posts if they were tempted by and clicked through one of these scams.
Reviewing installed Facebook applications periodically is also a smart idea to defend against many of the ways users are victimized on Facebook.
2. Via a Facebook Post
Here are a few common examples of likejacking:
- An image of a sick or injured child with text claiming that Facebook will donate € 1.00 toward the child’s care for every like.
- A false offer for a free voucher or gift card. These have included offers of € 50.00, € 100.00 and € 250.00 give-aways from certain well known mostly international Companies.
- A bogus offer for a free iPad, iPhone or other popular electronic device.
- An image of an attractive young woman along with a compelling message such as “The Prom Dress That Got This Girl Suspended From School.”
- An Invitation to help some abandoned or mistreated animal.
Unfortunately these Posts play on peoples emotions and are therefor fairly effective.
To protect yourself from likejacking, security experts recommend that you use caution in clicking, liking or sharing posts and be extremely skeptical about any free offers.