India Internet News

03 August 2011

Be careful while uploading your photos on Facebook since an Indian origin computer scientist has given a warning that in doing so you may help someone in stealing data from your computer. The scientist has made a botnet known as Stegobot to demonstrate how easy it would be for a scammer to hijack Facebook photos to create a secret communication channel which is very difficult to detect.

Just like other botnets, Stegobot can take the control of computers by tricking users into opening infected attachments or visiting suspect websites. But instead of contacting the botmasters directly, it traces the infected user's normal social network activity. Amir Houmansadr, a computer scientist of University of Illinois at Urbana-Champaign and worked on the botnet, said to New Scientist that "If one of your friends is a friend of a friend of the botmaster, the information transfers hop by hop within the social network, finally reaching the botmasters."

Stegobot has the benefit of a technology known as steganography that hides the details of images without changing their appearance. The botnet includes this details into any image that you upload to Facebook, and then awaits for one of your friends to view your profile. They did not even need to click on the picture, since Facebook willingly downloads files in the background. If your friend is also infected with the botnet than any picture they upload will also pass on the stolen details.

From there, the details will ultimately get its way to the account of someone who is also friends with the botmaster, enabling them to retrieve details about your identity. The botmasters can also forward commands to the botnet by the reverse process to upload a picture with hidden instructions that make their way to infected computers.

Shishir Nagaraja, who organized the project and belongs to the Indraprastha Institute of Information Technology, New Delhi, India, said, "It's scary because it's virtually undetectable."