Facebook scam uses the Signature Guy trick
-
-
I don't notice anything off.
-
So which is TRWTF:
1. Facebook doesn't sheild against signature guy.
-or-
2. The profile names all link to the Facebook page for the scam, which would make sense except YOU'RE ALREADY ON THE SCAMS PAGE.
-
@emurphy said:
Check out the comments on the Register tab. Yup, fake.
Requesting screenshots for those sane enough not to have a facebook account.
-
@emurphy said:
Seems to have been taken down already. I pre-emptively wrote this post, based on similar tricks I've seen before, but can't verify that it actually applies to the scam page in question here: however, odds are 100-to-1 that it was this:-Check out the comments on the Register tab. Yup, fake.
That's not "Signature Guy trick", and a good thing too. That's just a JPG image of some fake comments. If it was "Signature Guy trick", it would mean the app had found a way to bust out of the FBML and inject real content into the facebook page, effectively XSSing it. Which would be bad.
Alas, the evidence is gone so I can't find out for sure.
-
@DaveK said:
That's not "Signature Guy trick", and a good thing too. That's just a JPG image of some fake comments. If it was "Signature Guy trick", it would mean the app had found a way to bust out of the FBML and inject real content into the facebook page, effectively XSSing it. Which would be bad.
It wasn't a JPG. It was actual text and even some HTML controls.Rather frightening, actually.
-
@Weng said:
Have you still got it in your browser cache? Pastebin it if you do, please. Would be highly educative to look at.@DaveK said:
That's not "Signature Guy trick", and a good thing too. That's just a JPG image of some fake comments. If it was "Signature Guy trick", it would mean the app had found a way to bust out of the FBML and inject real content into the facebook page, effectively XSSing it. Which would be bad.
It wasn't a JPG. It was actual text and even some HTML controls.Rather frightening, actually.
-
@derula said:
@emurphy said:
Check out the comments on the Register tab. Yup, fake.
Requesting screenshots for those
saneugly and friendless enough not to have a facebook account.
-
@DaveK said:
Nah, it got nuked.Have you still got it in your browser cache? Pastebin it if you do, please. Would be highly educative to look at.
-
@morbiuswilters said:
FTFY@derula said:
@emurphy said:
Check out the comments on the Register tab. Yup, fake.
Requesting screenshots for those
saneugly and friendlesswho have a life in the real world.
-
@Zecc said:
Fixed that for accuracy.@morbiuswilters said:
FTFY@derula said:
@emurphy said:
Requesting screenshots for thoseCheck out the comments on the Register tab. Yup, fake.
saneugly and friendlesswho have a life in the real worldwith a couple real dolls and a blow up sheep.
-
@galgorah said:
@Zecc said:
Fixed that for accuracy.@morbiuswilters said:
FTFY@derula said:
@emurphy said:
Requesting screenshots for thoseCheck out the comments on the Register tab. Yup, fake.
saneugly and friendlesswho have a life in the real worldwith a couplerealdolls and a blow up sheep.FTFY. Also what's wrong with blow-up sheep? Placing a blow-up sheep box on your neighbor's doorsteps right before his wife gets home posing as a UPS drop off is rescipie for a hilarious evening.
-
@astonerbum said:
I think you sir need to look up what a real doll is. Their is a huge difference between a doll and a real doll. Real doll's are infinitly more creapy.@galgorah said:
@Zecc said:
Fixed that for accuracy.@morbiuswilters said:
FTFY@derula said:
@emurphy said:
Requesting screenshots for thoseCheck out the comments on the Register tab. Yup, fake.
saneugly and friendlesswho have a life in the real worldwith a couplerealdolls and a blow up sheep.FTFY. Also what's wrong with blow-up sheep? Placing a blow-up sheep box on your neighbor's doorsteps right before his wife gets home posing as a UPS drop off is rescipie for a hilarious evening.
-
@galgorah said:
@astonerbum said:
FTFY. Also what's wrong with blow-up sheep? Placing a blow-up sheep box on your neighbor's doorsteps right before his wife gets home posing as a UPS drop off is rescipie for a hilarious evening.
I think you sir need to look up what a real doll is. Their is a huge difference between a doll and a real doll. Real doll's are infinitly more creapy.
So creepy in fact that there was a movie made about them
-
@astonerbum said:
FTFY. Also what's wrong with blow-up sheep? Placing a blow-up sheep box on your neighbor's doorsteps right before his wife gets home posing as a UPS drop off is rescipie for a hilarious evening.
Are we talking about inflatable sheep or explosive sheep? I lost track."Lars and The Real Girl" was an okay movie. I'd watch it again, I guess.
-
@Zecc said:
@astonerbum said:
FTFY. Also what's wrong with blow-up sheep? Placing a blow-up sheep box on your neighbor's doorsteps right before his wife gets home posing as a UPS drop off is rescipie for a hilarious evening.
Are we talking about inflatable sheep or explosive sheep? I lost track."Lars and The Real Girl" was an okay movie. I'd watch it again, I guess.
It was cringe-inducing. The really odd part was that the dude never seemed to sleep with the real doll, which is the whole point of them. Also, they tried to paint him as sympathetic, instead of a creepy-ass psycho. Seriously, that chick who fell in love with him must have been seriously fucked up.
-
@morbiuswilters said:
Also, they tried to paint him as sympathetic, instead of a creepy-ass psycho. Seriously, that chick who fell in love with him must have been seriously fucked up.
Are we talking about Lars and The Real Girl or the Star Wars prequels?
-
@Someone You Know said:
Are we talking about Lars and The Real Girl or the Star Wars prequels?
Or Garden State?
-
@DaveK said:
Have you still got it in your browser cache? Pastebin it if you do, please. Would be highly educative to look at.
Here are Google cache links for a couple more instances of the same basic thing:
-
@Master Chief said:
So which is TRWTF:
1. Facebook doesn't sheild against signature guy.
-or-
2. The profile names all link to the Facebook page for the scam, which would make sense except YOU'RE ALREADY ON THE SCAMS PAGE.
The fact you now need a FB account to see WTFs instead of posting screenshots ;)
-
Any more info for somebody who doesn't know what the "Signature Guy trick" is? What am I looking for here? The login form at the top seems to go to the right URL....
-
@vt_mruhlin said:
It's creating a signature that contains all the HTML that effectively creates a whole fake post beneath yours.Any more info for somebody who doesn't know what the "Signature Guy trick" is?
Here; look at any posts by Quietust, and note the similarity of every single post after theirs.
-
@PJH said:
@vt_mruhlin said:
Namely this one referring to very phenomenon.
It's creating a signature that contains all the HTML that effectively creates a whole fake post beneath yours.Any more info for somebody who doesn't know what the "Signature Guy trick" is?
Here; look at any posts by Quietust, and note the similarity of every single post after theirs.
-
@emurphy said:
Haha, thanks, that did it. I tried searching it earlier but none of the ones I found in google's cache at the time had the relevant tab showing. A quick look at the source code led to this google search, where you can find numerous examples, and from there to this blackhat seo site and indeed this page.@DaveK said:
Have you still got it in your browser cache? Pastebin it if you do, please. Would be highly educative to look at.
Here are Google cache links for a couple more instances of the same basic thing:
-
@DaveK said:
BTW, this is pretty reassuring; they haven't found any way to XSS the thing, it's all just static FBML and doesn't appear to breach the sanitisation/filtering in any way.Haha, thanks, that did it. I tried searching it earlier but none of the ones I found in google's cache at the time had the relevant tab showing. A quick look at the source code led to this google search, where you can find numerous examples, and from there to this blackhat seo site and indeed this page.
Facebook
