title: Preventing the Osama Facebook worm
body: <p>There is a <a href="http://pastebin.com/uk0NZ758" rel="nofollow">javascript worm</a> spreading on facebook.  The worm tricks users into executing javascript by <a href="http://i.stack.imgur.com/6jvZf.png" rel="nofollow">copying and pasting the payload into the address bar</a>. This is <strong>not xss</strong>,  this is social engineering.   If you read the worm's source code you'll see that its riding on the session and forging requests like the Sammy worm.  What are some way that a web application can prevent this type of attack?</p>