Monday, October 30, 2017

Can you trust Facebook links?

While we are on Facebook, we are often share links to external sources, like Youtube, Google Drive, Instagram, or any other websites.
Many people think that Facebook links are quite reliable, but are they?

Facebook users can send those links via post or privately over Messenger, as you can see on the following images:






So how exactly preview link feature works?
When a user is about to post a link, he pastes it on Facebook, which detects it as a URL, then Facebook bot called “Facebook External Hit”, fetches a GET request to the supplied link and extract the relevant data from the HTML content such as preview image, title, description, and origin domain.
The link’s preview data is the only information supplied to the user before clicking it. In case the preview data is fake, it is super useful for phishing campaigns/ads/click fraud (pay-per-click)/Malvertising, just few days ago, I read this article about gigantic ad fraud on MySpace.


So after exploring this feature, I managed to understand how exactly the preview data was fetched, and what Facebook bot is looking for in the HTML content.
Facebook’s bot is looking for specific HTML tags, some of the tags it is looking for, are the “meta” tags, specifically with values “og:url” , “og:image” and “og:title” in the “property” attribute.
Due to lack of validation between the “og:url” content attribute to the origin domain retuned the HTML, it is possible to abuse this feature via crafted meta tags, so in case someone supplies to Facebook bot a URL that returns HTML with those crafted tags which contain fake data of another website (let’s say Youtube), the preview data will look like a Youtube song (or any other targeted page over the internet), but the actual link will lead victims to the URL containing the malicious HTML.
An example of HTML that fakes Youtube song link:




In my opinion, all Facebook users think that preview data shown by facebook is reliable, and will click the links they are interested in, which makes them easily targeted by attackers that abuse this feature in order to perform several types of attacks as I mentioned above (phishing campaigns/ads/click fraud pay-per-click).




I reported Facebook about this issue but unfortunately they refuse to recognize it as security issue and replied:
Facebook contains user-generated content, so the ability to inject content into a page, even under Facebook.com, is a very low-risk vulnerability. We consider content spoofing bugs like this to be low-risk and low-impact”



In addition, Facebook replied that the links posted are validated via system called “Linkshim”, in order to avoid phishing and malicious websites, but faking the meta tags is not considered as malicious activity.
we filter redirects through a system known as Linkshim…….. Feel free to test Linkshim against a URL belonging to a known malicious website, such as http://evilzone.org/


I explored how Linkshim works, which is probably part of the “Facebook External Hit” bot, I tried to publish a link that redirects user’s browser to “evilzone” but it was detected and removed (as shown the PoC video), then I thought, what if I supply Facebook bot just a normal fake HTML without any malicious code, but supply victims the malicious HTML?
PoC video:

The following code bypasses Linkshim system by detecting the bot request via User Agent (you can do so via detecting IP) and supply HTML with non malicious content while supplying the malicious HTML to victims:
In this article I did not show real-life attack scenario and didn't abused this feature for real malicious activity, but there is plenty ways to exploit this vulnerability in order to perform several types of attacks like stealing sensitive information like credentials/credit cards.
In summary,  I hope this post will make Facebook users aware of this issue and make Facebook addressed those vulnerabilities.


11 comments:

  1. From where did u get the meta tags for the youtube video?

    ReplyDelete
    Replies
    1. You can simply share the youtube link on Facebook and extract the relevant data for the meta tags from that

      Delete
    2. My names is Cathy i want to testify about the great spell caster called Priest Ade my husband and i have been married for 5 years now we don't have a child and the doctor told us i can't give birth because my womb have been damaged due to wrong drugs prescription this got me so worried and my husband was not happy so he decided to get married to another girl and divorce me i was so sad i told my friend about it she told me about a powerful spell caster she gave me his email address well i never believe in it that much though i just decided to give him a try and he told me it will take 24hrs to get my husband back to me and i will get pregnant i doubted him the 3rd day my husband came back to me and was crying he said he didn't want the divorce anymore 3 weeks after the doctor confirmed that i was pregnant he can also help you contact him at

      ancientspiritspellcast@yahoo.com or ancientspiritspellcast@gmail.com

      Blog: https://effectivespell1.blogspot.com

      Website http://ancientspiritspellcast.website2.me

      WhatsApp +2347059715465

      Delete
    3. I was crushed when my lover of three years left to be with another woman. I cried and sobbed every day, until it got so bad that I reached out to the Internet for help.And i saw a testimony of a spell caster who help a girl called Kate Jackson and i said let me give it a try so i contact him for help and he cast a love spell for me which i use in getting my love back and now i am a happy woman.For what you have done for me,i will not stop to share your goodness to people out there for the good work you are doing.I hope God blesses you as much as you have help me to get my Love back,visit him on OKAYASPELLHELP@GMAIL.COM,he is the only answer to your problems OKAYASPELLHELP@GMAIL.COM OR call/Whatsapp +27814506790

      Delete
  2. This comment has been removed by a blog administrator.

    ReplyDelete
  3. My names is Cathy i want to testify about the great spell caster called Priest Ade my husband and i have been married for 5 years now we don't have a child and the doctor told us i can't give birth because my womb have been damaged due to wrong drugs prescription this got me so worried and my husband was not happy so he decided to get married to another girl and divorce me i was so sad i told my friend about it she told me about a powerful spell caster she gave me his email address well i never believe in it that much though i just decided to give him a try and he told me it will take 24hrs to get my husband back to me and i will get pregnant i doubted him the 3rd day my husband came back to me and was crying he said he didn't want the divorce anymore 3 weeks after the doctor confirmed that i was pregnant he can also help you contact him at

    ancientspiritspellcast@yahoo.com or ancientspiritspellcast@gmail.com

    Blog: https://effectivespell1.blogspot.com

    Website http://ancientspiritspellcast.website2.me

    WhatsApp +2347059715465

    ReplyDelete
  4. I was crushed when my lover of three years left to be with another woman. I cried and sobbed every day, until it got so bad that I reached out to the Internet for help.And i saw a testimony of a spell caster who help a girl called Kate Jackson and i said let me give it a try so i contact him for help and he cast a love spell for me which i use in getting my love back and now i am a happy woman.For what you have done for me,i will not stop to share your goodness to people out there for the good work you are doing.I hope God blesses you as much as you have help me to get my Love back,visit him on OKAYASPELLHELP@GMAIL.COM,he is the only answer to your problems OKAYASPELLHELP@GMAIL.COM OR call/Whatsapp +27814506790

    ReplyDelete
  5. My name is Handford Ann,i base in canada.i want to share my wonderful testimony on how i got back my ex-lover of my life back, he left me for another woman for no reason and i try to make things work for both of us yet things where getting worse and i love him so much and there is nothing i could do to get my ex back until i met a testimony share by Maria from USA on the internet talking about a powerful spell caster who brought his ex lover back within 48hours and i decide to give it a try and to my greatest surprise he also did it for me just as he did for Maria and i have a lot of people complaining of fake spell caster but this one i met was a real spell caster who help me to solve my problem i have no solution to,i introduce many of my best friends that have a similar problems,and their problem were solve with the great help of Dr.Trust. They get back their ex within 48 hours. I am so happy that my ex is back to me again,and the most surprise,is that our love is very strong,every day is happiness and joy. and there is nothing like been with the man you love.i am so happy my love is back to me with the help of Dr.Trust. If you have any problem in your relationship i will advice you to contact him now (Ultimatespellcast@yahoo.com or Ultimatespellcast@gmail.com) His website for more testimony of him: http://utimatespellcast.blogspot.com Call or Text him now +1(317) 762-7416

    ReplyDelete
    Replies
    1. My Name is Ryan Ken i want to testify about Dr Okaya How he help me won the Lottery

      i won $1,000,000 in lottery, I took an advice from some person who talked about this great spell caster called Dr Okaya the person placed a testimonies on a blog saying how Dr Okaya helped him win the lottery by sending him the winning number i was curious and i thought it was all joke not until i contacted this spell caster to know for myself how this work cause i have spend a lot buying tickets and i never win. I contacted him and he told me the necessary thing that need to be done and i did it and he told me to wait for 24Hours and truly he gave me the winning numbers to play the lottery which i did, Can you believe my name was the first among winners. He told me (my son all i need you to do for me is make sure that you share this testimonies to others so that they can also win the lottery cause i do not have much time to spell on the internet) so that is why i am sharing this testimony with you that if you want to win the lottery this is the way online tips can help you, his email is OKAYASPELLHELP@GMAIL.COM OR call/Whats app +27814506790 is the only answer to that your problem of winning the lottery

      Delete
  6. My name is Handford Ann,i base in canada.i want to share my wonderful testimony on how i got back my ex-lover of my life back, he left me for another woman for no reason and i try to make things work for both of us yet things where getting worse and i love him so much and there is nothing i could do to get my ex back until i met a testimony share by Maria from USA on the internet talking about a powerful spell caster who brought his ex lover back within 48hours and i decide to give it a try and to my greatest surprise he also did it for me just as he did for Maria and i have a lot of people complaining of fake spell caster but this one i met was a real spell caster who help me to solve my problem i have no solution to,i introduce many of my best friends that have a similar problems,and their problem were solve with the great help of Dr.Trust. They get back their ex within 48 hours. I am so happy that my ex is back to me again,and the most surprise,is that our love is very strong,every day is happiness and joy. and there is nothing like been with the man you love.i am so happy my love is back to me with the help of Dr.Trust. If you have any problem in your relationship i will advice you to contact him now (Ultimatespellcast@yahoo.com or Ultimatespellcast@gmail.com) His website for more testimony of him: http://utimatespellcast.blogspot.com Call or Text him now +1(317) 762-7416

    ReplyDelete
  7. My Name is Ryan Ken i want to testify about Dr Okaya How he help me won the Lottery

    i won $1,000,000 in lottery, I took an advice from some person who talked about this great spell caster called Dr Okaya the person placed a testimonies on a blog saying how Dr Okaya helped him win the lottery by sending him the winning number i was curious and i thought it was all joke not until i contacted this spell caster to know for myself how this work cause i have spend a lot buying tickets and i never win. I contacted him and he told me the necessary thing that need to be done and i did it and he told me to wait for 24Hours and truly he gave me the winning numbers to play the lottery which i did, Can you believe my name was the first among winners. He told me (my son all i need you to do for me is make sure that you share this testimonies to others so that they can also win the lottery cause i do not have much time to spell on the internet) so that is why i am sharing this testimony with you that if you want to win the lottery this is the way online tips can help you, his email is OKAYASPELLHELP@GMAIL.COM OR call/Whats app +27814506790 is the only answer to that your problem of winning the lottery

    ReplyDelete