May | 2011 | Alexander's Posterous (migrated to wordpress)

Most facebook users probably have seen Like worms that trick users into authenticating an app or clicking on an invisible image to like or share the worms url and lure more people into visiting the page as well. Topics ranging from funny videos and “Who visited your profile” to “Charlie Sheen found dead” and a “Twilight game” are very capable of tricking users to click (that includes me in some cases even though I am very cautious).

These worms use some kind of tricks to propagate, either Javascript exploits, hidden Iframes, marking 20 people in a gallery as tagged, but it seems that this is not necessary at all, you just have to promise free credits and people will do the work themselves.

Take a look at a sample page, when you read the page closely, it becomes obvious why this is silly.

The pages are usually hosted at an url like freecreditssomething.blogspot.com and consist of a single page that explains the great “offer” that they have discovered.

The explanation tries to suggest that the offer is onyl valid when a few steps are followed and they can supposedly verify who completes the steps. This explanation is a lie, neither can an advertiser verify that a user has shared or liked a page or which facebook user was on their page (unless they use Facebook Connect than the user opts in) nor can an IP check be used to verify which facebook pages an user visited or where the message was posted.

Inmost cases, the text is full of errors, the title mayl say free facebook credits, but the text talks about farmville cash, obviously the pages are put together without much care and are copied from other scam pages or the text has simple typing errors.

Lets take a look at a sample page step by step: