The worm's landing page is brilliant -- alluring yet mysterious, and very clean, just like we techies like it. You see a picture of a model in lingerie looking back at you over her shoulder. To the side of the picture there is the simple text: "Wanna C Somthin' HOT!??" and under it: "Click Da' Button, Baby!"
Nothing happens when you enter the page except for the malicious activity, although a friendly looking picture, looking like a button, is indeed there.
A friend, Nick Fitzgerald, helped me analyze how the worm works. He writes about it in his blog:
As a personal lesson, I have to admit mea culpa. I saw the worm being posted from a friend's page and didn't believe it to be dangerous because the lure is pretty cool. So I reposted it without thinking and went to visit the page. Immediately a second post appeared, and after a moment's confusion, I removed them both.
"This worm uses what is technically known as a CSRF (Cross-site Request Forgery, also called XSRF) attack. A sequence of iframes on the exploit page call a sequence of other pages and scripts, eventually resulting in a form submission to Facebook "as if" the victim had submitted a URL for a wall post and clicked on the "Share" button to confirm the post."
This shows that even experts can become complacent and trust systems when they really shouldn't. It's a good reminder for me to be more careful with social networks, which for some reason I have grown used to trusting more, without even noticing it happen!
Even though it was only there for a few seconds, me posting the page to Facebook without checking first is by far more embarrassing than if I got infected. But this is how we learn. I share this moment of embarrassment with you so others will both learn from me. No matter who you are, these things can get you -- which is why being thoughtful online is a good idea.
Follow Gadi Evron on Twitter: http://twitter.com/gadievron
Gadi Evron is an independent security strategist based in Israel. Special to Dark Reading.