As the tech and investment banking worlds eagerly anticipate Facebook’s long-awaited initial public offering, the world’s largest social network is trying to put stops to a suspicious, but arguably benign, plugin.
According to a Brian Krebs report, Dru Mundorff of Arizona is shamelessly selling the “LilyJade” browser plugin on hackerforums.net for $1000 a pop. Krebs notes that Hackerforums is often scorned by the more elite hackers out there because of the forums appeal to script kiddies (read: it’s too mainstream).
LilyJade is spreading, as is typical on Facebook, by posting links to a video on users’ walls. When ‘Friends’ click the link, they are prompted to install a plugin in order to watch the video. That plugin is LilyJade, which then posts the same link on that users wall, and the process repeats itself.
What LilyJade actually does, according to Krebs, is allow its owner to replace legitimate, paid ads on sites like Facebook, Google, Youtube, or almost any other website with his or her own ads.
Krebs wrote that Mundorff used ‘Crossrider,’ a popular Javascript framework that expedites and simplifies the plugin building process, to build LilyJade.
“We’re not forcing any users to be bypassed, exploited or anything like that,” Mundorff told Krebs in a phone interview. “At that point, if they do agree, it will allow us to make posts on their wall through our system.”
Mundorff doesn’t appear to think he is doing anything illegal. In fact, he even had his lawyer sign off on his terms of service.
Needless to say, Facebook isn’t pleased with the emergence of a plugin that overrides paid advertisements, their main revenue stream, particularly at a time when they are trying to get as generous a valuation as possible for the IPO. They recently sent Mundorff a cease-and-desist.
“Plugins such as LilyJade are configured to modify our [site] to inject ads and/or send spam through Facebook to the victim’s friends via wall posts and chat messages,” Fred Wolens, public policy manager at Facebook, told Krebs in a statement. “These alterations materially change people’s Facebook experience and bypass Facebook’s quality and security controls.”
In a later interview, Mundorff told Krebs that he has no intention of complying with Facebook’s request.
“I pretty much told them to go [expletive] themselves cause we cant post on anyones [sic] walls with out there [sic] permissions automated or not,” Mundorff told Krebs. “So they can go to hell.”
You can find Brian Krebs’s excellent piece of reporting here.
