Facebook Widget Installing Spyware
Fortinet Global Security Research Team discovered a malicious Facebook Widget (officially, a “Platform Application") actively spreading on the social networking site which ultimately prompts users to install the infamous “Zango” adware/spyware.
Context & Ripple Effects
Facebook spent 2007 answering the question CNET posed back in May 2007 about whether third-party widgets were coming: it opened the Platform, grew explosively through the year, and let outside developers build 'Platform Applications' directly into the social graph. That openness is exactly what Fortinet's Global Security Research Team is now exploiting a case study from — a widget actively spreading on the site whose endgame is getting users to install Zango adware.
The find lands during an already rough stretch for Facebook's trust posture: within days of this report the company had banned Robert Scoble for running a script to extract friends' email addresses under its Terms of Use, and was confirmed to be using profile pictures and endorsements in ads without explicit user opt-in. A spyware-pushing application compounds a pattern where the platform's growth levers — open developer access, aggressive data use — are the same ones eroding user confidence.
First-order effects
- Users who install the widget are prompted onto the infamous Zango adware/spyware, meaning Facebook's own application directory is functioning as a distribution channel for unwanted software right now.
- Facebook's enforcement apparatus, already exercised by the Scoble account disablement over Terms-of-Use violations, now has to police malicious applications rather than just automated data extraction.
Second-order effects
- Legitimate Platform developers face guilt-by-association: every spyware incident raises the bar for review and vetting across the entire application ecosystem Facebook built its 2007 growth strategy on.
- Security vendors like Fortinet gain a new research franchise in social-network threats, and advertisers exposed via Facebook's profile-picture ad practices have fresh reason to question brand safety on the platform.
Third-order effects
- If open-platform social networks cannot vet applications at scale, third-party app ecosystems will force platforms to choose between gated approval processes and ceding their name to whatever spreads — a structural tension between openness and trust that defines platform governance.
- Social graphs become a first-class malware vector: trusted-network recommendations are precisely what makes a Zango prompt more effective than email-borne equivalents, pulling antivirus research permanently onto social platforms.
The trend: As social networks open their platforms to third-party developers, the applications themselves become the primary malware delivery mechanism, forcing platform owners into an arms race between openness and security vetting.