Researcher publishes proof-of-concept code for creating Facebook worm

A Polish security researcher has published today details and proof-of-concept code that could be used for creating a fully functional Facebook worm. This code exploits a vulnerability in the Facebook platform that the researcher --who goes online under the pseudonym of Lasq-- has seen being abused in the wild by a Facebook spammer group. The vulnerability resides in the mobile version of the Facebook sharing dialog/popup. The desktop version is not affected. Lasq says that a clickjacking vulnerability exists in this mobile sharing dialog that an attacker can exploit through iframe elements. The spammer group who appears to have found this issue before Lasq has been (ab)using this vulnerability to post links on people's Facebook walls.