Maybe some of you got an email from an otherwise trusted friend about “99% of people can’t watch this video more than 25 seconds.”  and either a link to a website or a Facebook page. The page then instructs you to paste some Javascript code into your browser window. Nifty attack to gain access to all your friends’ information through the Facebook SocialGraph API (remember? You’re logged in through the Cookie in your browser).

Traditional web filters, firewalls, and virus scanners on clients could update their lists of malicious sites, or specifically interpret Javascript and scan for any attack before executing (could be a Mozilla Firefox or Google Chrome Plugin).

But my problem is with “What’s Hot Now” real-time search engines. Alexa collects data from various sources, others like Buzzd aggregate current buzz from Facebook, Yelp, Twitter, Google Buzz, Yammer, CitySearch, etc. Unfortunately, these aggregation and real-time search sites might spread the word on the malicious Javascript – if the script creates tweets and status messages, the real-time engines pick it up as well.

I’m looking for some enterprise scanner or consumer plugin to kill these messages – either test and delete them from the server and data before they get posted, or have a Firefox plugin that deletes/hides the HTML element on a “What’s Hot Now” site like Alexa’s and thus never shows it to you.

By the way: Aggregators like Buzzd mike find this a very attractive business opportunity – correlate buzz across different networks, identify spam and attacks, and peer this information back or to a third-party like Norton, Symantec, Microsoft, Google, Yahoo, Verizon, T-Mobile etc. There’s your exit option ;)