MacOS – “AddressBookUrlForwarder”

facebookmacosmalware

Today I clicked a link on Facebook and a dialogue window gave me the message:

"The link needs to be opened with an application. Send to:
AddressBookUrlForwarder

Upon examining the link, it had the format:

fb://photo/12345678?set=blahblahlblah

I've never seen a browser link with the "fb://" protocol before and certainly never heard of "AddressBookUrlForwarder".

So I did a finder search and came up with nothing. Then I did a Locate search from terminal and found:

/System/Library/CoreServices/AddressBookUrlForwarder.app

So I open "/System/Library/CoreServices/" in finder and that app doesn't show up. But it's definitely there. Thinking it must have some extended attributes or ACL I do an "ls-lae@" in the coreservices directory and for all intents and purposes it appears to be a normal .app directory with no @ or + or anything special to hide it from the Finder.

What the heck is going on? What is this app? Why is it not showing up in Finder? What is an "fb://" protocol link?

I'm creeped out now.

Also, I'm using 10.8.4.

Best Answer

I'm guessing that this application is used to retrieve Facebook and Twitter contact details for display in the address book.

This assumption is based on release notes for a recent update of Mac OS X, as well as the content of that application's executable (as viewed with strings):

strings /System/Library/CoreServices/AddressBookUrlForwarder.app/Contents/MacOS/AddressBookUrlForwarder`).

The output of strings makes me think that the application is a URL handler for these expressions:

...
_urlPatterns
http://www.facebook.com/profile.php?id=$1
fb://profile/(.*)
http://twitter.com/$1
twitter:///user[?]screen_name=(.+)
http://twitter.com/share?text=$1
twitter:///post[?]message=(.+)
...

Do you have a Facebook account setup in System Preferences -> Mail, Contacts & Calendars?

Related Question