You may have already heard about the malicious attacks contained in Facebook apps that were circulating this week and last. If you didn't, now would be a good time to give yourself a quick refresher on spotting an app that is just a little bit off when you're on Facebook.
Before we get right into it though, I'll admit that I get invitations for various applications from people in my friends list all day everyday. If I were to sum up the entire gist of this post to make it simple, I would say; if it looks strange, acts strange, comes from a stranger or contains the word "strange", don't accept it. Period - end of story. Side-note, I just had to search the word "strange" in Facebook apps and believe it or not, there are 12. So, to you 12 app builders, I'm sorry if I've offended you, it's nothing personal, I just can't have you on my FB page (especially that one with the clown face as a graphic...but that's a whole other post). Peace.
Need a little more solid visual? This part's for you.
Last week, I was the lucky recipient of a notification that looked just like this:
Pretty innocent right? WRONG! Oh, so wrong. First, this particular person is in my "Business Only" friend list (I've covered their last name for privacy) and we've never had a conversation, let alone 'oooh'd and aahhh'd' over each others photos. Second, look at the wording for the notification. It says Matthew XXXXX "commented on your photo". What's strange about that you ask? This is what it looks like when someone really comments on one of your photos through the Facebook utility:
Subtle, but important. The Facebook phrase is "made a comment about your photo". Your first inclination would likely be to see which photo someone has commented on right? Well in the rogue application, notice that only the word "photo" is hyperlinked. In the Facebook utility, the words "your photo" are hyperlinked.
What should happen when you click "photo" or "your photo"? When all is right in the world, once clicked, you should be taken imediately to the photo that was commented on. However, with this rogue application, you're taken to this screen:
And this is where it gets dangerous. Of course I didn't hit the "Allow" button, but this is where the malicious nature of the app takes place. If someone were to click "Allow", identity information, malicious sites and viruses are all possibilities for results. There are a couple of things about this that should make you feel a bit unsettled. First, the name of the app is strange in that only the first letter of the title is capitalized. Second, there is not graphic (image) for the app. Third, it's only got a rating of 1 star. Now a 1 star rating does not automatically mean that an app is bad, but it should give you some room for pause. After all, isn't social media all about a user-generated environment? If your peers only give something 1 star, they may be on to something. And lastly, there is no general description of what the app is intended to do.
Remember that old saying: "if you have to ask, you can't afford it"? Well apply similar logic to apps not built by Facebook by saying to yourself: "if they won't tell me what it does, I don't want it."
This is what a valid app "Allow" screen should look like:
You can always do an apps search to see what you can learn about a particular app prior to allowing access by going to the "Applications" button located in the lower-left corner of Facebook and clicking the "Browse More Applications" link and then typing in your keyword(s) into the search box (the one with the mini magnifying glass).
As a matter of fact, we did an app search for "Tag a pic" and this was the result:
Let me state that the result is not "Tag a pic", but the developers of fbquick may have utilized those words in their description. It seems that "Tag a pic" does not exist in the registry of Facebook applications which should give you your definitive answer that this was indeed a rogue application.
Here are some questions to use when evaluating whether or not an app is dangerous.
- Who did the app invitation come from? Are they a true friend or acquaintance (if you don't know the person at all, don't accept an app invitation plain & simple)? If they are, is the type of app that they sent characteristic of their normal behavior?
- Does the title of the app look strange? Is the app something you've never heard of before? Does the app provide you with a detailed description of the intended purpose? Have you used the FB search apps function to better research?
- Does the app have its own FB fan page? Do the developers of the app disclose who they are?
- When you run your cursor over the hyperlinked words, what url shows up? Does the url look strange
Have you received any strange apps? We'd like to hear from you, so please feel free to comment below. You can Digg this or add it as a favorite on Delicious immediately below. If you found this helpful, please pass it along and subscribe to our blog.
