Upon loading this message, it is possible to change the status of the user by including a link to a fraudulent site. "The status messages are very effective in terms of clickthrough rates because they are aimed at a limited number of friends," said BitDefender adding that it is easily possible to point to a page that contacts an operator fault Internet Explorer, Java, Flash or PDF.
The publisher advises to block the reception of messages from outside contacts, an option disabled by default. Sunnyvale firm has been advised of this vulnerability and is working on a fix.
