Securing Friendster Profiles - Explained

NOTE : This article is intended for EDUCATIONAL PURPOSES only. Do not attempt to perform your own 'phishing' method learned from this article. The purpose of this article is to expose the real methods behind the popular phishing method and alerting Friendster users pertaining to it.

Nowadays, even social networking sites can be easily injected with XSS codes, thus performing some malicious operations, and the two utmost techniques would be cookie grabber and phishing method.

In this article, I shall be explaining the methods used by phishers in hijacking one's Friendster account easily, and efficiently. Even though Friendster is trying their level best to update their filtration system, but XSS geeks won't be giving up their desire to inject some XSS craps in a Friendster profile. Recently, there has been too many cases of Friendster phishers going around and hijacking profiles, hence I wrote this article.

Previously, I had posted a new method to execute javascripts externally via XSS and based on that method, many other 'evil' operations could be done.

First and foremost, phishers would usually register an account under a free host, which supports mainly PHP and without any advertisements. This is to ensure that the 'Friendster Re-login' page they are about to make would be 'as real as it is'. Next, they would create a page, similar to that of Friendster's 'Your cookies had expired, please re-login!' page. Some might had encountered this before while some had not. Personally, I had encountered this many times due to my sucky web browser and its bloody settings.

Then, in that 'Friendster Re-login' page, there would be a portion which requires you to enter your email and password in order to 'continue'. Statistically, 90% of normal Friendster users would enter their details and hit the login button. It depends on the phisher himself on where he wants to redirect the user once their details had been logged/submitted. Some might redirect them to the Friendster homepage, some might redirect them to another profile and so on.

So, what actually happens when the user hit the Login button? There could be two options to be exact, one is to store the details in a text file, and another sending those details to the phisher's email. All this is done via the form action, which is controlled by a PHP file. Advanced phishers would prefer to see their victim's IP address, browser, date, time and etc, so, all this information could even be retrieved with a single line of code in that PHP file.

I don't want to explain any further as it might be a 'tutorial' for some in learning to phish Friendster accounts. Anyway, to all the Friendster users out there, kindly open your eyes and keep staring at the URL field located at the top of your browser and make sure it starts with http://www.friendster.com/………..

And, keep changing your passwords from time to time. Beware!