The business of hacking your Facebook account

Scammers are moving away from email to social networks, taking advantage of insecure accounts to send real-looking scam messages.

But how are criminals doing this? Trend Micro shared an example of how an account is hacked from the original message a user will receive, to the point where the domain owner makes business by harvesting emails.

The Scam

First of all, a message is sent to a user on Facebook, MySpace, Bebo, or a similar social network. It says: "Did you know your profile pic is over gabblebase.com?"

If you click on www.gabblebase.com - it's not a malicious link, but you may get seriously annoyed by the fact it's difficult to get away from the page - you can follow the steps through with a fake identity to see how it works. One of the options you will get is to put a password for your pictures.

The tendency for some users is to use a common password for every site that they use. If a user opts for a password they use for the social network they were originally sent the message for, they've done three things: they've showed what social network they're on, given an email address, and given a password all you need to hack a Facebook or email account.

The fake site has a disclaimer claiming it will never send spam to your email address and is not a MySpace or Facebook login page, a clever way of making the user feel more comfortable.

Researching Gabblebase, Trend Micro revealed that it was linked to a server in Las Vegas run by someone called Adam Arzoomanian. He owns 423 domains in total, to avoid being blocked by filters.

The Business Model

Trend Micro revealed that the domain of the site was Chinese and called 'dreamstarmail'. The owners of the site now have all the details that they would need to enter a social networking or email account - and therefore send messages in an attempt to part users from their money.

Members who referred users to this criminal site also had the potential to earn money by taking a percentage of the profits the email harvesters made.

Trend Micro security advisor Rik Ferguson said: "This neat little social engineering trick is relying on users' habit of using common passwords, so now the criminal would have your email and your password. It's pay day."