The next time a long-forgotten Facebook friend sends you an odd picture, it’s probably best to leave it alone.
Cyber-criminals have found a creative way to weasel into your computer: implanting malicious code inside a Facebook Messenger picture.
For the most part, the Facebook messaging app is tightly controlled, and doesn’t give hackers a lot of opportunity to mess with users. The app does allow users to embed a photo into a conversation, however, and that’s how the trick works. Discovered by security researcher Bart Parys, who wrote about it on Sunday after a friend spotted it on Facebook, it relies on the fact that Facebook lets users embed images as .svg files, a lesser-used file extension. It’s possible to fill an .svg file with script, as happened with the attack Parys noticed. – READ MORE
