Anonymous Facebook Threat May Be Malware Lure

A YouTube video purporting to be from hacktivist collective Anonymous threatened to “destroy” Facebook for spying on users and abusing people’s privacy. But is it just a hoax?

A YouTube video posted on July 16 under the Anonymous banner and entitled “Message from Anonymous: Operation Facebook, Nov. 5, 2011” suddenly went viral this week. The video, uploaded by a user named FacebookOp, claimed Anonymous will target and “kill” Facebook on November 5 for co-operating with governments and handing over user data.

“If you are a willing hacktivist, or a guy who just wants to protect the freedom of information, then join the cause and kill Facebook for the sake of your own privacy,” said a robotic voice in the video.

Probably No Action

Even though the disembodied voice sounds the same as the one used in previous messages from Anonymous, some security professionals are dubious the threat is real because it has not been repeated by Anonymous in any of its “official” Twitter accounts or posted on the AnonOps site.

The fact that the video was posted almost a month ago and has not been widely publicised was a clue, according to Rik Ferguson, director of security research and communication at Trend Micro.

Eugene Kaspersky, CEO of Kaspersky Lab, posted on Twitter: “The news around #Anonymous to attack #Facebook on November 5 most probably is fake.”

The difficulty in determining whether or not this is a real threat lies in the fact that Anonymous is a loosely knit collective of like-minded individuals. They do not act in concert, and there is no real hierarchy. So it is possible that this may be a group of anarchy-minded hacktivists doing their own thing.

“No one can speak for the whole of #Anonymous. There are some anons who support #OpFacebook whilst others do not,” according to the GroupAnon Twitter feed.

Another Anonymous account, AnonOps, posted, “Don’t be silly. Important things are happening in the world to deal with quirks like #OpFacebook. Let’s keep our style & moral #Anonymous.” Earlier, AnonOps used even stronger language, calling the “op” a fake because “we don’t ‘kill’ the messenger. That’s not our style”.

The Twitter account associated with the video, OP_Facebook, has been inactive since July 16, when it made the initial post with the YouTube link. Kaspersky noted that the links on the account went to Websites with suspicious advertisements.

False Claims Of Collusion

The FacebookOp video made a number of unfounded claims, such as accusing Facebook of “selling information” to Egyptian and Syrian government agencies to spy on the local population and “giving clandestine access” to information security firms about users on the site.

The OP_Facebook video warned, “Facebook knows more about you than your family.”

While it may be true for many users, it is “not exactly Facebook’s fault” as the company only knows what users choose to post on the site, Paul Ducklin, head of technology for the Asia-Pacific group in Sophos. wrote in the Naked Security blog, How much users reveal or do not reveal should be their choice, and for someone else to kill it off entirely to further their agenda “is arrogant and self-righteousness”, Ducklin said.

Ducklin said the threat amounts to a “concept of an Internet regulated” by a single group.

The date of the attack, November 5, is known in the United Kingdom as Guy Fawkes Night. In 1605, Guy Fawkes was arrested in what became known as the “gunpowder plot”. He stored a massive amount of gunpowder in a cellar room under the British parliament with plans to cause mayhem by blowing up the building while parliament, overseen by the king, was in session.