Some Facebook users have been infected with a worm after clicking on an image of a scantily clad woman, which then redirects the victims to a pornography site, according to security researchers.

The worm posts an image on a victim's Facebook Wall with a photo of a woman in a bikini and the message "click 'da button, baby." Wall posts are viewable by a Facebook user's friends.

If a friend clicks on the image and is logged into Facebook, the image is then is posted to their own Wall. Their Web browser will then open a Web page with a larger version of the same image. A further click on "da button" redirects the friend to a pornography site, according to Roger Thompson chief research officer for antivirus vendor AVG Technologies. Thompson posted a video of the attack on his blog.

The creators of the worm are likely making money by driving referrals to the pornography site, said Nick FitzGerald, a threat researcher for security vendor AVG.

Researchers aren't quite sure exactly how the worm works but believe it may be a cross-site request forgery attack (CSRF) or a clickjacking attack or a mix of both.

A CSRF attack occurs when a victim's credentials are used to perform some action but without their knowledge. In this case, the attacker fraudulently posts the image to the victim's Facebook Wall, piggybacking on the fact the victim is logged into their account.

Another possibility is clickjacking, where attackers use special Web programming to trick victims into clicking Web buttons without realizing it.

Clickjacking is possible due to a fundamental design feature in HTML that allows Web sites to embed content from other Web pages. Web browsers are vulnerable to clickjacking attacks, although browser makers have worked to shore up defenses against them.

Facebook classifies the attack as clickjacking, an attack that is "not specific to Facebook," according to a written statement. Facebook also said the attack was not a worm.

"We've taken action to block the URL (Uniform Resource Locator) associated with this site, and we're cleaning up the relatively few cases where it was posted," the statement said. "Overall, an extremely small percentage of users were affected."

If the worm does spread through a clickjacking attack, "it may be difficult for Facebook to fix reliably," FitzGerald said. "Regardless, it is a worm."

Facebook warned users not to click on suspicious links. However, in this case, the link doesn't stand out as necessarily suspicious given the variety of Wall postings, graphics and applications that appear all over the popular social-networking site.

Labels: Facebook

Intel's Core i9 chips won't hit the market for a few more months, but that hasn't stopped Polish site PCLab from putting the new 32-nanometer processor through its paces in a recent series of benchmark tests.

While testing the pre-release 2.8 GHz Gulftown chip, PCLab found a significant speed increase with certain applications. According to their report, certain resource-intensive tasks, such as editing video or 3D modelling, perform up to 50% faster than Intel's current Core i7 chip.



Unfortunately, the chip didn't shine in all areas; its performance is similar to that of older Core i7 chips when handling less demanding general activities.

However, the Core i9 CPUs fared well when it came to power usage, using less power and running cooler compared to older chips.

These results, which you can read in full here, could change before the Core i9's release in the first quarter of next year, so watch this space.

Labels: intel, Processors

Office 2010's 64-bit edition -- the upcoming suite is the first that Microsoft will produce a version specific for 64-bit versions of Windows -- boasted 150 seeders but fewer than 50 leechers. More than 1,400 copies of the 710MB file had been downloaded by mid-day.

According to Neowin.net , the Office 2010 build is tagged as 14.0.4514.1009, and requires an activation key.

Users commenting on Mininova.org confirmed that the leaked beta installs and works, although many complained that they needed a product key to activate the suite so it could be used for longer than 30 days. Several others, however, offered up workarounds to sidestep activation.

When Microsoft launched the public beta of Windows 7, and then the follow-up release candidate, it provided limited-time product activation keys to users. Presumably, the company will repeat that practice with the Office 2010 beta.

Previews of Office 2010 have leaked before official availability twice already this year. In May, a week after Microsoft announced that it would issue the Technical Preview in the summer, an early edition showed up on BitTorrent. The same thing happened in July, when the Technical Preview went public hours before Microsoft revealed the invite-only test program at its Worldwide Partner Conference (WPC).

Earlier this week, Microsoft shut down Technical Preview downloads, and told testers to expect news of the public beta next week. Microsoft will kick off its annual Professional Developers Conference (PDC) next Monday in Los Angeles, and is expected to use that forum to unveil the public beta.

Last year, Microsoft released an alpha build of Windows 7 to PDC attendees.

Microsoft has also been dropping broad hints of an impending Office 2010 public beta on its Twitter feed. "MS Office team has some exiting news to tell at PDC. This is a must attend event. Stay tuned!" Microsoft tweeted Tuesday morning.

It's unclear whether Microsoft will cap the number of Office 2010 downloads, a move that would duplicate the clumsy process last January when it launched Windows 7's public beta, or whether it will simply limit time the beta is available, which is what it did with Windows 7 release candidate.

Microsoft has, however, promised to distribute millions of copies of the Office 2010 public beta.

Labels: Microsoft

An organization called Control Your Info has taken control of hundreds of Facebook groups. Those groups had administrators that eventually stepped down from their position, creating a power vacuum at the top. According to the organization, when the administrator steps down, anyone can take over a group, view the members' personal information, and change group information to say whatever they want. Control Your Info believes that the way Facebook handles group administration is a major flaw. And it wants to bring that to everyone's attention.

"Hello, we hereby announce that we have officially hijacked your Facebook group," a message written on Monday reads on one hijacked group. "This means we control a certain part of the information about you on Facebook. If we wanted, we could make you appear in a bad way which could damage your image severely."

Labels: News

If the size of your Google cloud is starting to look like Act IV of A Perfect Storm, you'll probably be interested in the company's latest feature, Google Dashboard--a one-stop shopping overview of all your Google cloud services, with links to preferences and privacy settings for each. (The Dashboard link is somewhat buried on your account settings page, so you might want to bookmark google.com/dashboard.)

Dashboard requires you to log in even if your browser is already logged into your Google account--a thoughtful security precaution considering how many services are collated here. On my Dashboard, I have an overview of my usage of twelve different Google services, ranging from Gmail to YouTube, with nine more services helpfully collected at the bottom of the page as "not yet available" in Google Dashboard. Seeing how much data you have stashed on Google servers in one go can be somewhat mesmerizing--and if you're so inclined, you might want to go back into moribund services and either clean them out and make them useful. (Somehow, I don't think I'll ever need immediate Web access to my calendar from July 2006.)

I'm a fairly early adopter of most things coming out of Google Labs, so while I don't know that this is a canonical list, here's what I currently see in Dashboard: Account, Alerts, Calendar, Contacts, Docs, Gmail, iGoogle, Reader, Talk, Voice, Web History, and YouTube. (No, I don't have a Wave account yet. Hint, hint.) Services not included: Analytics, AdSense, FeedBurner, Google Base, Google Groups, Maps, News, Page Creator, and Subscribed Links.

Labels: Google

Google Apps users can expect to see significant improvements in the suite's voice- and video-chat capabilities, as the company builds on Gmail's current features in that area.

Gmail's voice and video chats are now limited to one-to-one communications, but Google wants to broaden that capability to more than two participants and make it more robust all around for Apps.

"This [current Gmail capability] is the first step in a much broader set of features we hope to roll out over the next six to 12 months around video [and voice] chat capabilities," said Rishi Chandra, a Google Apps product manager. "It's a great opportunity for us to push that space along."

Apps, a Web-hosted communication and collaboration suite for workplaces, is used by more than 20 million people in more than 2 million organizations.

In planning these enhancements, Google has decided not to add a separate application to the suite, Chandra said.

Instead, the experience of launching a voice or video chat session should flow seamlessly from within Gmail and mesh organically with the other Apps components. "It should be embedded in the core experience across the application set," he said.

Google isn't disclosing further details about its plans. The company acquired Web and video conferencing software in 2007 from Swedish company Marratech.

Beefing up video and voice communications within Gmail is a good decision because e-mail remains the most-used enterprise application by information workers, said Sheri McLeish, a Forrester Research analyst.

In a recent Forrester survey of 2,001 information workers in the U.S., 87 percent said they use e-mail, and among those, almost all use it at least once every day. Almost 60 percent of respondents use it at least once every hour.

"People are in e-mail all the time, so efforts to offer solutions that sit outside of an inbox tend not to have tremendous success," McLeish said.

Labels: Google

Aside from the much-awaited line of Fermi-based GeForce graphics card is NVIDIA also planned to reveal a different model, namely the GeForce 240 GT, aimed at the mainstream market, constructed using a new generation of 40nm graphics processor company. The latest rumors have surfaced on the Internet, said card in mid-November, so ATI fans with a choice of DirectX 10.1-compliant solution that reportedly ran around the same level as GeForce 9600 GT models.

Labels: Hardware