Facebook said Wednesday that it has tracked down the scammers responsible for a spam attack that flooded the social network with pornographic and violent imagery this week.
"In addition to the engineering teams that build tools to block spam we also have a dedicated enforcement team that has already identified those responsible and is working with our legal team to ensure appropriate consequences follow," a Facebook spokesman said today.
Yesterday, security firm Sophos said in a blog post that Facebook had been awash in objectionable material over the previous 24 hours. "The content, which includes explicit hardcore porn images, photoshopped photos of celebrities such as Justin Bieber in sexual situations, pictures of extreme violence and even a photograph of an abused dog, have been distributed via the site—seemingly without the knowledge of users," said security consultant Graham Cluley.
Facebook later confirmed that it had been hit with "a coordinated spam attack that exploited a browser vulnerability." The company said its efforts "drastically limited the damage caused by this attack."
According to Facebook, users were "tricked into pasting and executing malicious javascript in their browser URL bar causing them to unknowingly share this offensive content." Engineers have since built "enforcement mechanisms" to shut down the offending Pages, as well as accounts that exploit the vulnerability, Facebook said.
"We have also been putting those affected through educational checkpoints so they know how to protect themselves," the company continued. "We've put in place backend measures to reduce the rate of these attacks and will continue to iterate on our defenses to find new ways to protect people."
Facebook has had some success in going after spammers. In August, Facebook "spam king" Sanford Wallace turned himself in to the FBI after being indicted on charges of spamming Facebook users with millions of bogus messages.
That case dated back to 2009, when Facebook sued Wallace and two other spammers for phishing and spamming schemes that compromised many accounts. The social-networking site obtained a restraining order in February 2009 and a $711 million judgment in October, the second-largest in history for an action brought under the federal CAN-SPAM Act. The case was then referred to the U.S. Attorney's office for possible criminal charges, which resulted in Wallace's indictment.