There's always a new way to misuse complex software systems and Facebook is fertile ground for such things. The latest—at least I haven't seen it before—is image tag spam. This involves tagging a user on an image that contains spam content.

That user's friends will get a message that he was tagged, so you want to tag users with lots of friends. The image nearby is a test, but makes the basic point. The image my friend got tagged in (no, the girl in the picture isn't my friend) has several very popular users in it.

So how its it done? After all, you can generally only tag users who are your friends. In this case, the image belonged to a group which my friend didn't "Like" so it seemed out of the blue. We still haven't figured out exactly what happened; Facebook didn't respond to my inquiry on it and the image is still up in spite of my friend reporting it as abusive. But I think that either my one of friend's Facebook friends either did the tagging intentionally or one of them got his account hijacked.

Just another thing to keep in mind when you see something that doesn't look quite right on Facebook.

Originally posted to the PCMag.com security blog, Security Watch.