Shaakunthala's Portal

Recently I saw some videos spreading on Facebook. 'Spreading', in the sense that people watch and share. What so special with these videos was, their thumbnails had that "Youtube feel", but seemed bit different. Also, most of these had eye-catching titles (in Sinhala), and eye-catching thumbnails (For example, a girl changing her dress... ;-) ).

I actually clicked on one of these to play the video. Then it took me to a Facebook application page where it prompted me to grant permissions to a Facebook app called "Gindara videos". Why would I ever let a Facebook app to access my personal information when I have dozens of better ways to anonymously watch video on the Internet? As a matter of fact, I stopped there. Access denied, Gindara videos go fly a kite, please.

Few days back I saw a girl has shared another video of the same type. She is a fun person I know, but it was bit of odd thing that she would share such a thing publicly. So I left a chat message to her jokingly, "what are these things you post on fb? :P", and she replied, "seriously i didn't know. :'(".

Then I wanted to have a close look at the phenomenon. "Gindara videos" is a malware hosted on a Sri Lankan website called tharunaya.co.uk. This is not the only such malware seen on the Internet. Even years ago, there have been many of this type. But I feel this particular malware remained on Facebook for sometime longer than the previous ones, totally because people's ignorance. Their targeted victims seemed to be Sri Lankans and that may be the reason for such long lasting. If it ever had a 'global presence', not very long time it takes to vanish from Facebook.

Whenever you spot that kind of video or any malicious post on Facebook, take a moment to report them for spam. It's more of a civic duty. After reading the story below this picture, you'll better understand why you should report them.

Just report it for Spam

I did a piece of Holmes stuff and found out that these guys are using tool called "Facebook Viral Videos App With Auto Share" from a vendor called Appstico. As the name says, it's a 'viral' app which can automatically share videos on Facebook. Now, look at my friend's reply above again... she didn't know that she has shared a video on Facebook.

I don't want to promote Appstico's blackmarket stuff here, but just putting a nofollow hyperlink for you to go through it as understand what these guys do with YOUR personal information that YOU allow them to see.
http://appstico.com/facebook-viral-videos-app-with-auto-share/

This is what exactly tharunaya.co.uk/Gindara all about. In short, here's how it works.

1. There's a bunch of bad guys who want few more visitors coming into their website.
2. They deploy a virus. A social virus which uses human mind as its career and people's curiosity as the exploit.
3. Misled people just want to watch something that is rarely or never seen for real. No time to worry about privacy!
4. The video hyperlink on Facebook actually directs the victim to the bad guys' website.
5. It doesn't stop there. Without victim's knowledge, it posts a video hyperlink to the victim's Facebook timeline, which can be seen by other people.
6. They get more traffic, more traffic is more profit, and target accomplished. And the poor victim even doesn't know that someone has used him/her until a friend pokes.

Let's have a look at the 2nd step above. These 'Tharunaya' guys do business and their sole purpose is to increase their business. Who has time to learn how to make a virus from A to Z? So they outsource it to another party. And that another party is Appstico.

(click to enlarge)

Appstico also does is business, and knows that there are many bunches of bad guys who want more business coming in. So Appstico makes a package for everyone, and sell it to the bad guys just for one hundred US dollars. Bad guys just rename it to "Gindara videos" and make use of it. How clever is that?

Would you still let them to use you? Myself, I wouldn't. The more you report these malicious activities for spam, less they get spread. Eventually the viral app will be taken out by Facebook. And as I said above, it's a civic duty to report malicious things, as it helps to keep Facebook clean and safe place for people.

It doen't cost much time - usually lesser than to watch a video :-)

Theoretically this entire blog post is all about a separate area in Internet security called "Social Engineering". To end this blog post, I'll leave that for your further reading:
http://en.wikipedia.org/wiki/Social_engineering_%28security%29

Thanks for reading!

* If anyone is interested, I have proof of what I speak.