The Secret Crush application, which at the time of writing has over 50,000 daily users on Facebook, invites people to find out who amongst their friends has a secret crush on them. Users tempted to discover more have to invite at least five other Facebook users to install the application before their mystery admirer is revealed.
However, no secret crush is ever revealed. Instead users are directed to an external Web site which invites Facebook users to download potentially unwanted applications such as MyWebSearch that will display pop-up advertising.
"Whoever wrote this Secret Crush application is cashing-in big time, by encouraging people to download the adware. As an affiliate for the people displaying the nuisance pop-up adverts, they are getting paid for each successful installation," said Graham Cluley, senior technology consultant for Sophos. "Facebook users must show greater discretion about how they use the site, and which applications they install. These third party widgets are not written by Facebook, and can mean that you are carelessly sharing your personal information with strangers or risking your computer's security."
Experts believe that companies need to set policies regarding Facebook usage, and implement Web security solutions, to prevent dangers entering the workplace.
"Companies need to make their own mind up as to whether they want to allow their users to access Web sites like Facebook and MySpace during office hours. If workers are allowed to be given access to these sites then it's vital that they do not put their personal and corporate data at risk," explained Cluley. "If your users are installing third party Facebook applications in the office they could potentially be bringing adware, spyware and malware into your organization at the same time. The best defense is for businesses to defend themselves with a Web security and control appliance which can filter internet access and prevent the downloading of malicious code."
Sophos notes that although Facebook appears to have removed Secret Crush from its search results, it is still possible at the time of writing to install the offending application.
"Facebook has thousands of third party applications available on its site for members to install, and it's obviously proving impossible for them to police them all," continued Cluley. "The message from Facebook to its users appears to be 'add third party applications at your own risk'."
