Beware of Facebook Spam Wall Posts

Are you on Facebook? Have you ever received a strange message from a friend that looked something like this? I received not one, but two of these in one day.

Facebook Spam

A Free iPad?

Sounds too good to be true? Then it probably is. But how did my friend end up posting this to my wall? They definitely couldn’t have posted it manually, because when I view their profile, this is what I see:

Facebook Spam Profile

The list actually goes on for quite a while.

So how did my friend end up posting this link to everyone’s wall?

Malicious Script Scam

Facebook Wall Dislike Spam

Click Enable Dislike Button and then a Dislike button will magically appear on your account!

A very common way Facebook pages spam your friends is through a malicious script scam, which promises something will happen by copying/pasting a line of script into the URL bar. Common messages include getting a Dislike button, seeing who views your profile, or proving that your account is active so Facebook won’t delete it.

Facebook Dislike Scam

Copy and paste this "perfectly harmless" looking external script and your account will get a Dislike button.

In the above screenshot, during that “1 minute of processing”, the script is spamming wall posts to all of your friends. The script is sneaky by using an external script URL so the amount the user copies doesn’t look like a lot. It’s also unbelievably easy to edit HTML to add a Dislike button to make fake proof.

If you’re curious about what the script actually contains, click here to view a screenshot of the full external script code from the above screenshot. See if you can read part of it and figure out what it does.

This script can do anything from sending messages to your friends to giving you a malware infection. The example above only spams your friends and doesn’t actually cause any malware infection, but that may change since its hosted by a third party.

Don’t believe any of these posts/pages because Facebook definitely does not delete inactive accounts, there’s absolutely no way to track your profile views, and there’s no such thing as an official dislike button.

And never copy/paste anything into your URL bar unless you know what you’re doing.

Bad Permissions

Another way is through giving permissions. They probably unknowingly allowed a malicious or spam application permission to post on friends’ walls. When giving permissions to any third party application, Facebook asks the user to explicitly give the app permission by pressing an Allow button, but most people end up pressing this button without reading what permissions they’re giving.

Some apps ask for permission to do everything, including post on walls and access your data at any time.

Facebook Permissions

Pressing allow here could cause quite a lot of problems.

Be very careful with what permissions you’re giving to apps. If you accidentally clicked Allow, immediately head to Account > Privacy Settings and then at the bottom, click Edit Settings under Apps and Websites. Remove any application that seems suspicious.

Only allow apps from publishers you trust to access your data and always be alert of the permissions you’re allowing.

Facebook does a very good job with removing spam pages, spam apps, and blocking links, but there’s always some time before a new one comes up and it getting blocked.

And the most important rule with everything is… if it sounds too good to be true, it probably is.

Have you been a victim of these spam posts, whether being the account that’s spamming or the account being spammed? Have more tips on preventing such things from happening? Share your thoughts with us.

Liked this article? Share it with your friends.

Brian is the co-founder of TechAirlines. He is a developer currently focusing on mobile and web development. He is currently a sophomore at Stony Brook University, majoring in Computer Science.

  • Brian Yang

    The dislike button spam/scam I used as an example in this post is currently spreading very rapidly as a variation to the previous “Account Verification” and “Profile Peeker”.

    Never copy and paste any chunk of Javascript into the URL bar.

    Having the ‘Enable Dislike Button’ appear next to the Like and Comment links makes it very convincing, but do not fall for the trick.

    Sophos Security published an article on this issue earlier today:

  • Cyberguy

    Good post, I think people should be more aware of these scams. I have had a few of those in the past few weeks but didn’t fall for them. I regularly clean up apps I don’t use.

    Another type of scam is that you receive a facebook mail saying a friend posted something on your wall. The post is in a language your friend doesn’t even use and when you look it is not even on your wall. A way to direct you to malicious places.

  • Chrissy Jamie

    The sad thing is that not many people submit facebook spam, they just ignore it and think it will go away! I will say I don’t think facebook does a very good job of letting people know how they can report these kinds of things…they change up their UI it seems like every other day…

    • Brian Yang

      I completely agree. I see a lot of people simply post a message saying “Sorry about the random messages, I got hacked” after they discover what happened. Unfortunately, they technically were not “hacked”. In addition, very few of them actually do anything about it or even try to figure out how they got hacked.

      Facebook typically just removes the spam pages and blocks links but there are no notifications to users. Most users aren’t going to read their Security FAQ or blog (both of which are buried within tiny links from the footer links) so will be completely unaware.

  • dj emi

    Thats true brian.I receive such posts too on my wall.