Wasn’t it to my surprise when a friend’s son hit me up yesterday on Facebook chat. We don’t usually chat so I was curious as to what was going on.

Although he 1st asked how I was, he quickly said he needed help to post an ad on a popular french classifieds website, leboncoin.fr. Although suspicion rose immediately, as a security researcher, I was very curious to see where this was going to lead.

The ad is for a car, and although he tells me to list the required fields so that he can give me all the requested information, my friend seems to have his text all prepared. He seems to be rather pasting chunks of text, with fields I haven’t even mentionned.

Giving me fields I haven't mentionned.

When I ask why the car is being sold in a totally different area from ours (800km away), he says it is for his aunt. I don’t want to question him too much, so I just keep on copying the information he is giving me. He gives me an email address, a phone number, links to pictures of the car, and a password for the ad. At this point, I’m not sure what his motives are. It is probably a false ad with hopes of getting the money for this non-existent car, but why would he need me to post it for him? Is his IP address blocked from the website? Or is this a way of trying to hide his traces? As he’s given me a password, it is certainly not a way to try to get any of the passwords I might commonly use on the Internet.

The classified's vendor details.

When I validate the ad, an email with a confirmation link is sent to the address I have provided. My friend copy/pastes the url into Facebook chat so that I can confirm. He asks me to copy/paste the message from the website to ensure I have really validated.

Asking me to prove I have validated the ad.

This guy seems to not want to waste much time. He is giving short and clear directions on what to input, how to download the pictures. Not once does he say “please” or “thanks”, or tries to make a bit of conversation. When I ask why he needs me to post the ad for him, he first eludes the question, but when I insist he eventually says it’s because the website won’t show on his computer. Then out of nowhere he asks whether I’ve seen the “new Facebook”. It’s pretty obvious I have as I have the new Timeline on my profile, and oh, so does he!

Link to the "new Facebook".

Of course, it is a phishing site to steal user credentials so that he can later hijack more Facebook profiles. This site does not even try to look like the real Facebook. It is called “Facebook L0ve”, and yes, with a ’0′ instead of a capital ‘O’.

The new Facebook L0ve.

Now at the lab we’re curious to find out where this guy is. So we lure him into a “hot” MSN chat while we quickly set-up a webserver with photos for him to visit so that we can get his IP address and geolocalize it. Needless to say the MSN ID he gives me is another different email address, one he most probably uses to pass as a pretty girl to lure men into a fake romance!

As it turns out, our foe is in Benin, and it is not the 1st recorded scam of this type coming from there. So if a “friend” hits you up to post an ad for him/her, or asks you to click on a link:

• Make sure it is really your friend, by asking for example if it is sunny in Alaska (and they normally live in Florida)
• Tell your real friend their profile has been hijacked and they need to inform Facebook about it
• Report the scam to your local Internet Complaint Center (USA: http://www.ic3.gov, France: https://www.internet-signalement.gouv.fr)
• Report the fake ad to the website (leboncoin.fr)

The following video clip instructs users how to setup FortiClient Lite on Android devices.

The video includes explanations of the features of FortiClient Lite and how set the software up on both the Android and FortiGate devices. FortiClient Lite Android was released from beta in December 2011 and features SSL VPN connectivity.

A question and answer forum can be found at:

http://support.fortinet.com/forum/tt.asp?appid=6

Alternatively, users may ask questions directly from their Android device using the “Report a Problem” feature located in FortiClient Lite’s menu.

Stay tuned for more updates on our mobile products!

It was a busy year in the world of network security. The threat landscape is constantly changing and we try to keep you posted on what’s going on with our FortiGuard blog. We’ve compiled our top 10 FortiGuard blog posts throughout 2011.

Carrier IQ on Android – FAQ
Android Malware Surges in 2011
Fortinet Security Minute for September 2011
Threat Landscape Midyear in Review
Apple Plays Cat-and-Mouse Game with Mac Malware Makers
World IPv6 Day
Phishing 101
Stop Your Computer From Becoming a Zombie!
40th Anniversary of the Computer Virus
What’s Not Going to Happen in 2011: Anti-Predictions

Have you subscribed to the FortiGuard blog’s RSS feed?
Subscribe Now.

In this edition of Security Minute, Derek Manky, Fortinet’s senior security strategist, wraps up 2011 with his predictions of the type of network security threats we might see in 2012. Here’s a link to the full report for more detailed info: http://blog.fortinet.com/2012-threat-predictions/

Now that the holidays are over, many users will be bringing their new devices and gadgets into the workplace in the new year. Fortinet’s Derek Manky and Network World’s Keith Shaw discuss some of the risks associated with these devices, and how companies need to update their BYOD (Bring Your Own Device) policies to make sure end users understand the risks and consequences. (12:41)