Facebook Chat Bot Hijacks Accounts, Annoys Users
UPDATE: This story has been updated with a response from the ChatSend support team.
A malicious app called ChatSend has been sweeping through Facebook, taking over accounts and using each one as a home base to send self-advertising spam.
On its website, ChatSend markets itself as a "social file sharing" service that enables users to instantly share files on Facebook, Twitter, Google+ and AOL Instant Messenger. The app is compatible with Internet Explorer, Safari, Firefox and Chrome Web browsers, which in part is why it is such an annoyance to those who make the mistake of downloading it.
ChatSend, according to the security firm GFI Labs, installs its toolbar in all Web browsers, and then proceeds to send automated messages to Facebook users' friends, each with a message that says they downloaded ChatSend, and a link pointing back to a URL, www.chatsnd.net, that instantly downloads the app to a users' computer. (The app's website is ChatSend.com; the discrepancy between the link and the site's actual URL should be a sign that the app is suspicious.) The app's deliberately difficult to read End User License Agreement (EULA) should also tip people off that something is not entirely right with it.
But apparently these potential red flags are not enough to stop eager and not- always-security-conscious Facebook users from downloading ChatSend: More than 136,000 people have already "liked" the app on Facebook. That's about 20,000 more than when GFI first spotted ChatSend making the rounds yesterday (Oct. 31).
The makers of ChatSend did not return an email for comment.
Facebook has taken notice that ChatSend is a rogue app, and has identified it as malware and blocked it. If you've downloaded the malicious app, remove it from your account by going to "Add/Remove Programs" on Facebook and uninstalling ChatSend. As an extra safety measure, run an anti-virus scan to ensure it hasn't dropped any malicious files onto your system.
UPDATE: In an email, a ChatSend support representative assured SecurityNewsDaily that the security bug that caused ChatSend to send spam messages has been identified and fixed, and that ChatSend, based in India and Israel, "is a working application and is not a hack of some kind."
In regards to GFI Labs' assertion that ChatSend's EULA is deliberately difficult to read, ChatSend told SecurityNewsDaily that it found no evidence supporting GFI Labs' claim. "The EULA can be found both in our website and appears while downloading the software," ChatSend's support rep said. "I have also compared it to both Facebook and Skype ones and it seems quite similar."
ChatSend also released an updated installer that no longer requires users to scroll horizontally to read the EULA.
- Beyond Facebook: 14 Social Networking Alternatives
- Miley Cyrus Sexy Photo Hacker Avoids Hard Time
- Best Anti-Virus Software Review
