Monday, October 30, 2017

Can you trust Facebook links?

While we are on Facebook, we are often share links to external sources, like Youtube, Google Drive, Instagram, or any other websites.
Many people think that Facebook links are quite reliable, but are they?

Facebook users can send those links via post or privately over Messenger, as you can see on the following images:






So how exactly preview link feature works?
When a user is about to post a link, he pastes it on Facebook, which detects it as a URL, then Facebook bot called “Facebook External Hit”, fetches a GET request to the supplied link and extract the relevant data from the HTML content such as preview image, title, description, and origin domain.
The link’s preview data is the only information supplied to the user before clicking it. In case the preview data is fake, it is super useful for phishing campaigns/ads/click fraud (pay-per-click)/Malvertising, just few days ago, I read this article about gigantic ad fraud on MySpace.


So after exploring this feature, I managed to understand how exactly the preview data was fetched, and what Facebook bot is looking for in the HTML content.
Facebook’s bot is looking for specific HTML tags, some of the tags it is looking for, are the “meta” tags, specifically with values “og:url” , “og:image” and “og:title” in the “property” attribute.
Due to lack of validation between the “og:url” content attribute to the origin domain retuned the HTML, it is possible to abuse this feature via crafted meta tags, so in case someone supplies to Facebook bot a URL that returns HTML with those crafted tags which contain fake data of another website (let’s say Youtube), the preview data will look like a Youtube song (or any other targeted page over the internet), but the actual link will lead victims to the URL containing the malicious HTML.
An example of HTML that fakes Youtube song link:




In my opinion, all Facebook users think that preview data shown by facebook is reliable, and will click the links they are interested in, which makes them easily targeted by attackers that abuse this feature in order to perform several types of attacks as I mentioned above (phishing campaigns/ads/click fraud pay-per-click).




I reported Facebook about this issue but unfortunately they refuse to recognize it as security issue and replied:
Facebook contains user-generated content, so the ability to inject content into a page, even under Facebook.com, is a very low-risk vulnerability. We consider content spoofing bugs like this to be low-risk and low-impact”



In addition, Facebook replied that the links posted are validated via system called “Linkshim”, in order to avoid phishing and malicious websites, but faking the meta tags is not considered as malicious activity.
we filter redirects through a system known as Linkshim…….. Feel free to test Linkshim against a URL belonging to a known malicious website, such as http://evilzone.org/


I explored how Linkshim works, which is probably part of the “Facebook External Hit” bot, I tried to publish a link that redirects user’s browser to “evilzone” but it was detected and removed (as shown the PoC video), then I thought, what if I supply Facebook bot just a normal fake HTML without any malicious code, but supply victims the malicious HTML?
PoC video:

The following code bypasses Linkshim system by detecting the bot request via User Agent (you can do so via detecting IP) and supply HTML with non malicious content while supplying the malicious HTML to victims:
In this article I did not show real-life attack scenario and didn't abused this feature for real malicious activity, but there is plenty ways to exploit this vulnerability in order to perform several types of attacks like stealing sensitive information like credentials/credit cards.
In summary,  I hope this post will make Facebook users aware of this issue and make Facebook addressed those vulnerabilities.


19 comments:

  1. From where did u get the meta tags for the youtube video?

    ReplyDelete
    Replies
    1. You can simply share the youtube link on Facebook and extract the relevant data for the meta tags from that

      Delete
    2. My names is Cathy i want to testify about the great spell caster called Priest Ade my husband and i have been married for 5 years now we don't have a child and the doctor told us i can't give birth because my womb have been damaged due to wrong drugs prescription this got me so worried and my husband was not happy so he decided to get married to another girl and divorce me i was so sad i told my friend about it she told me about a powerful spell caster she gave me his email address well i never believe in it that much though i just decided to give him a try and he told me it will take 24hrs to get my husband back to me and i will get pregnant i doubted him the 3rd day my husband came back to me and was crying he said he didn't want the divorce anymore 3 weeks after the doctor confirmed that i was pregnant he can also help you contact him at

      ancientspiritspellcast@yahoo.com or ancientspiritspellcast@gmail.com

      Blog: https://effectivespell1.blogspot.com

      Website http://ancientspiritspellcast.website2.me

      WhatsApp +2347059715465

      Delete
    3. I was crushed when my lover of three years left to be with another woman. I cried and sobbed every day, until it got so bad that I reached out to the Internet for help.And i saw a testimony of a spell caster who help a girl called Kate Jackson and i said let me give it a try so i contact him for help and he cast a love spell for me which i use in getting my love back and now i am a happy woman.For what you have done for me,i will not stop to share your goodness to people out there for the good work you are doing.I hope God blesses you as much as you have help me to get my Love back,visit him on OKAYASPELLHELP@GMAIL.COM,he is the only answer to your problems OKAYASPELLHELP@GMAIL.COM OR call/Whatsapp +27814506790

      Delete
    4. MY HUSBAND IS BACK WITH THE GREAT HELP OF DR SAM LOVE SPELL

      Hi everyone, I Was going crazy when my husband breakup with me and left me for another woman!! All thanks to Dr Sam the best love spell caster online that helped me to bring back my husband today and restore happiness in my marriage.. I'm Grecia Cruzi by name i lives in United States. My husband breakup with me and left me to be with another woman, and i wanted him back. I was so frustrated and i could not know what next to do again, I love my husband so much but he was cheating on me with another woman and this makes him break up with me so that he can be able to get married to the other lady and this lady i think use witchcraft on my husband to make him hate me and my kids and this was so critical and uncalled-for, I cry all day and night for God to send me a helper to get back my husband!! I was really upset and i needed help, so i searched for help online and I came across a website that suggested that Dr Sam can help get ex back fast. So, I felt I should give him a try. I contacted him and he told me what to do and i did it then he did a spell for me. 28 hours later, my husband really called me and told me that he miss me so much, Oh My God! i was so happy, and today i am happy with my man again and we are joyfully living together as one big family and i thank the powerful spell caster Dr Sam, he is so powerful and i decided to share my story on the internet that Dr Sam is best spell caster online who i will always pray to live long to help his children in the time of trouble, if you are here and your lover is turning you down, or your husband moved to another woman, do not cry anymore, contact this powerful spell caster Dr Sam on his email at: (Supremespellcast@gmail.com Or Supremespellcast@yahoo.com WhatsApp +2347087462033) com you can visit his Website Via> http://supremespellcast.website2.me Or his blog> https://supremespellcast.blogspot.com

      Delete
    5. My name is SHERRY WALJER from USA Massachusetts, i want to testify to the general public how my relationship was restored back by the great power's of Dr Larry after three months of loneliness, my ex-lover called me after my contact with Dr Larry that he want us to come back and start a good home, now we are happily together again as lovers. All thanks to Dr Larry who did a love spell for me for my ex lover to return home. I will keep sharing this until people who also need help see this for his wonderful help. You can contact him on his via email assurancesolutionhome@gmail.com or whatsapp him on +1(424)-261-8520.
      https://assurancesolutionhome.blogspot.com




      My name is SHERRY WALJER from USA Massachusetts, i want to testify to the general public how my relationship was restored back by the great power's of Dr Larry after three months of loneliness, my ex-lover called me after my contact with Dr Larry that he want us to come back and start a good home, now we are happily together again as lovers. All thanks to Dr Larry who did a love spell for me for my ex lover to return home. I will keep sharing this until people who also need help see this for his wonderful help. You can contact him on his via email assurancesolutionhome@gmail.com or whatsapp him on +1(424)-261-8520.
      https://assurancesolutionhome.blogspot.com

      Delete
    6. REAL ONLINE LOVE SPELL CASTER THAT BROUGHT BACK MY EX LOVER YOU CAN EMAIL HIM on supernaturalspell@yahoo.com or whatsapp him +2348124644470
      Hello everyone i know there is someone somewhere reading this,My name is lisa donna from USA,I want to share a great work of a spell caster called PRIEST WISDOM my husband and i had a fight which led to our divorce but when he left me a part of me left with him and i was to sad and cried all day and night i was searching something online when i saw people testifying about his great work and i just decided to give him a try i did everything he told me to do and he assured me that after 24 hours my husband will come back to me,the next morning to my greatest surprised a car stopped outside my house and it was my husband i'm so happy he can also help you email him at supernaturalspell@yahoo.com or whatsapp him +2348124644470 ... OR VIEW THIS https://lettalaabourtrelationship.blogspot.com








      REAL ONLINE LOVE SPELL CASTER THAT BROUGHT BACK MY EX LOVER YOU CAN EMAIL HIM on supernaturalspell@yahoo.com or whatsapp him +2348124644470
      Hello everyone i know there is someone somewhere reading this,My name is lisa donna from USA,I want to share a great work of a spell caster called PRIEST WISDOM my husband and i had a fight which led to our divorce but when he left me a part of me left with him and i was to sad and cried all day and night i was searching something online when i saw people testifying about his great work and i just decided to give him a try i did everything he told me to do and he assured me that after 24 hours my husband will come back to me,the next morning to my greatest surprised a car stopped outside my house and it was my husband i'm so happy he can also help you email him at supernaturalspell@yahoo.com or whatsapp him +2348124644470 ... OR VIEW THIS https://lettalaabourtrelationship.blogspot.com

      Delete
  2. This comment has been removed by a blog administrator.

    ReplyDelete
  3. My names is Cathy i want to testify about the great spell caster called Priest Ade my husband and i have been married for 5 years now we don't have a child and the doctor told us i can't give birth because my womb have been damaged due to wrong drugs prescription this got me so worried and my husband was not happy so he decided to get married to another girl and divorce me i was so sad i told my friend about it she told me about a powerful spell caster she gave me his email address well i never believe in it that much though i just decided to give him a try and he told me it will take 24hrs to get my husband back to me and i will get pregnant i doubted him the 3rd day my husband came back to me and was crying he said he didn't want the divorce anymore 3 weeks after the doctor confirmed that i was pregnant he can also help you contact him at

    ancientspiritspellcast@yahoo.com or ancientspiritspellcast@gmail.com

    Blog: https://effectivespell1.blogspot.com

    Website http://ancientspiritspellcast.website2.me

    WhatsApp +2347059715465

    ReplyDelete
  4. I was crushed when my lover of three years left to be with another woman. I cried and sobbed every day, until it got so bad that I reached out to the Internet for help.And i saw a testimony of a spell caster who help a girl called Kate Jackson and i said let me give it a try so i contact him for help and he cast a love spell for me which i use in getting my love back and now i am a happy woman.For what you have done for me,i will not stop to share your goodness to people out there for the good work you are doing.I hope God blesses you as much as you have help me to get my Love back,visit him on OKAYASPELLHELP@GMAIL.COM,he is the only answer to your problems OKAYASPELLHELP@GMAIL.COM OR call/Whatsapp +27814506790

    ReplyDelete
  5. My name is Handford Ann,i base in canada.i want to share my wonderful testimony on how i got back my ex-lover of my life back, he left me for another woman for no reason and i try to make things work for both of us yet things where getting worse and i love him so much and there is nothing i could do to get my ex back until i met a testimony share by Maria from USA on the internet talking about a powerful spell caster who brought his ex lover back within 48hours and i decide to give it a try and to my greatest surprise he also did it for me just as he did for Maria and i have a lot of people complaining of fake spell caster but this one i met was a real spell caster who help me to solve my problem i have no solution to,i introduce many of my best friends that have a similar problems,and their problem were solve with the great help of Dr.Trust. They get back their ex within 48 hours. I am so happy that my ex is back to me again,and the most surprise,is that our love is very strong,every day is happiness and joy. and there is nothing like been with the man you love.i am so happy my love is back to me with the help of Dr.Trust. If you have any problem in your relationship i will advice you to contact him now (Ultimatespellcast@yahoo.com or Ultimatespellcast@gmail.com) His website for more testimony of him: http://utimatespellcast.blogspot.com Call or Text him now +1(317) 762-7416

    ReplyDelete
    Replies
    1. My Name is Ryan Ken i want to testify about Dr Okaya How he help me won the Lottery

      i won $1,000,000 in lottery, I took an advice from some person who talked about this great spell caster called Dr Okaya the person placed a testimonies on a blog saying how Dr Okaya helped him win the lottery by sending him the winning number i was curious and i thought it was all joke not until i contacted this spell caster to know for myself how this work cause i have spend a lot buying tickets and i never win. I contacted him and he told me the necessary thing that need to be done and i did it and he told me to wait for 24Hours and truly he gave me the winning numbers to play the lottery which i did, Can you believe my name was the first among winners. He told me (my son all i need you to do for me is make sure that you share this testimonies to others so that they can also win the lottery cause i do not have much time to spell on the internet) so that is why i am sharing this testimony with you that if you want to win the lottery this is the way online tips can help you, his email is OKAYASPELLHELP@GMAIL.COM OR call/Whats app +27814506790 is the only answer to that your problem of winning the lottery

      Delete
  6. My name is Handford Ann,i base in canada.i want to share my wonderful testimony on how i got back my ex-lover of my life back, he left me for another woman for no reason and i try to make things work for both of us yet things where getting worse and i love him so much and there is nothing i could do to get my ex back until i met a testimony share by Maria from USA on the internet talking about a powerful spell caster who brought his ex lover back within 48hours and i decide to give it a try and to my greatest surprise he also did it for me just as he did for Maria and i have a lot of people complaining of fake spell caster but this one i met was a real spell caster who help me to solve my problem i have no solution to,i introduce many of my best friends that have a similar problems,and their problem were solve with the great help of Dr.Trust. They get back their ex within 48 hours. I am so happy that my ex is back to me again,and the most surprise,is that our love is very strong,every day is happiness and joy. and there is nothing like been with the man you love.i am so happy my love is back to me with the help of Dr.Trust. If you have any problem in your relationship i will advice you to contact him now (Ultimatespellcast@yahoo.com or Ultimatespellcast@gmail.com) His website for more testimony of him: http://utimatespellcast.blogspot.com Call or Text him now +1(317) 762-7416

    ReplyDelete
  7. My Name is Ryan Ken i want to testify about Dr Okaya How he help me won the Lottery

    i won $1,000,000 in lottery, I took an advice from some person who talked about this great spell caster called Dr Okaya the person placed a testimonies on a blog saying how Dr Okaya helped him win the lottery by sending him the winning number i was curious and i thought it was all joke not until i contacted this spell caster to know for myself how this work cause i have spend a lot buying tickets and i never win. I contacted him and he told me the necessary thing that need to be done and i did it and he told me to wait for 24Hours and truly he gave me the winning numbers to play the lottery which i did, Can you believe my name was the first among winners. He told me (my son all i need you to do for me is make sure that you share this testimonies to others so that they can also win the lottery cause i do not have much time to spell on the internet) so that is why i am sharing this testimony with you that if you want to win the lottery this is the way online tips can help you, his email is OKAYASPELLHELP@GMAIL.COM OR call/Whats app +27814506790 is the only answer to that your problem of winning the lottery

    ReplyDelete
    Replies
    1. REAL ONLINE LOVE SPELL CASTER THAT BROUGHT BACK MY EX LOVER YOU CAN EMAIL HIM on supernaturalspell@yahoo.com or whatsapp him +2348124644470
      Hello everyone i know there is someone somewhere reading this,My name is lisa donna from USA,I want to share a great work of a spell caster called PRIEST WISDOM my husband and i had a fight which led to our divorce but when he left me a part of me left with him and i was to sad and cried all day and night i was searching something online when i saw people testifying about his great work and i just decided to give him a try i did everything he told me to do and he assured me that after 24 hours my husband will come back to me,the next morning to my greatest surprised a car stopped outside my house and it was my husband i'm so happy he can also help you email him at supernaturalspell@yahoo.com or whatsapp him +2348124644470 ... OR VIEW THIS https://lettalaabourtrelationship.blogspot.com






      REAL ONLINE LOVE SPELL CASTER THAT BROUGHT BACK MY EX LOVER YOU CAN EMAIL HIM on supernaturalspell@yahoo.com or whatsapp him +2348124644470
      Hello everyone i know there is someone somewhere reading this,My name is lisa donna from USA,I want to share a great work of a spell caster called PRIEST WISDOM my husband and i had a fight which led to our divorce but when he left me a part of me left with him and i was to sad and cried all day and night i was searching something online when i saw people testifying about his great work and i just decided to give him a try i did everything he told me to do and he assured me that after 24 hours my husband will come back to me,the next morning to my greatest surprised a car stopped outside my house and it was my husband i'm so happy he can also help you email him at supernaturalspell@yahoo.com or whatsapp him +2348124644470 ... OR VIEW THIS https://lettalaabourtrelationship.blogspot.com

      Delete

  8. HOW I GOT BACK MY EX LOVER BY HELP OF DR LUCKY

    My Name is make peek will love to share my testimony to all the people in the forum because i never thought i will have my girlfriend back and she means so much to me..The girl i want to get marry to left me 4 weeks to our wedding for another man..,When i called her she never picked my calls,She deleted me on her Facebook and she changed her Facebook status from engage to Single…when i went to her place of work she told her boss she never want to see me..I lost my job as a result of this cos i cant get myself anymore,my life was upside down and everything did not go smooth with my life…I tried all i could do to have her back to all did not work out until i met a Man when i Travel to Germany to execute some business have been developing some years back..I told him my problem and all have passed through in getting her back and how i lost my job…he told me he gonna help me…i don’t believe that in the first place.but he swore he will help me out and he told me the reason why my girlfriend left me and also told me some hidden secrets.i was amazed when i heard that from him..he said he will cast a spell for me and i will see the results in the next couple of days..then i travel back to Germany the following day and i called him when i got home and he said he’s busy casting those spells and he has bought all the materials needed for the spells,he said am gonna see positive results in the next 2 days that is Thursday.My girlfriend called me at exactly 11:42pm on Thursday and apologies for all she had done ..she said,she never knew what she’s doing and her sudden behavior was not intentional and she promised not to do that again.it was like am dreaming when i heard that from her and when we ended the call,i called the man and told him my my girl friend called and he said i haven’t seen anything yet… he said i will also get my job back in 3 days time..and when its Sunday,they called me at my place of work that i should resume work on Monday and they gonna compensate me for the time limit i have spent at home without working..My life is back into shape,i have my girlfriend back and we are happily married now with a baby boy and i have my job back too.This man is really powerful..if we have up to 20 people like him in the world,the world would have been a better place..he has also helped many of my friends to solve many problems and they are all happy now..Am posting this to the forum for anybody that is interested in meeting the man for help.you can reach him on Email; Realspellcasteronline@gmail.com he is very powerful and can solve any kind of problem below.
    Do you want your ex lover back?
    Do you want to get pregnant?
    Do you want your husband to appreciate you?
    Do you want to be famous or rich?
    Do you want to be a celebrity?
    Do you your business to grow excessively?
    Do you want to be honorably good academically?
    Do you need a job?
    Do you need a husband?
    Do you have problem in your marriage life?
    Contact Dr Lucky today for speed help:(Realspellcasteronline@ gmail. com ) Beware of scams

    Thanks to Dr Lucky for bringing back my wife,and brought great joy to my family?

    What a miracle spell caster that bring back my Husband Called Dr. Lucky the powerful spell caster email (Realspellcasteronline@gmail .com)

    ReplyDelete
  9. MY HUSBAND IS BACK WITH THE GREAT HELP OF DR SAM LOVE SPELL

    Hi everyone, I Was going crazy when my husband breakup with me and left me for another woman!! All thanks to Dr Sam the best love spell caster online that helped me to bring back my husband today and restore happiness in my marriage.. I'm Grecia Cruzi by name i lives in United States. My husband breakup with me and left me to be with another woman, and i wanted him back. I was so frustrated and i could not know what next to do again, I love my husband so much but he was cheating on me with another woman and this makes him break up with me so that he can be able to get married to the other lady and this lady i think use witchcraft on my husband to make him hate me and my kids and this was so critical and uncalled-for, I cry all day and night for God to send me a helper to get back my husband!! I was really upset and i needed help, so i searched for help online and I came across a website that suggested that Dr Sam can help get ex back fast. So, I felt I should give him a try. I contacted him and he told me what to do and i did it then he did a spell for me. 28 hours later, my husband really called me and told me that he miss me so much, Oh My God! i was so happy, and today i am happy with my man again and we are joyfully living together as one big family and i thank the powerful spell caster Dr Sam, he is so powerful and i decided to share my story on the internet that Dr Sam is best spell caster online who i will always pray to live long to help his children in the time of trouble, if you are here and your lover is turning you down, or your husband moved to another woman, do not cry anymore, contact this powerful spell caster Dr Sam on his email at: (Supremespellcast@gmail.com Or Supremespellcast@yahoo.com WhatsApp +2347087462033) com you can visit his Website Via> http://supremespellcast.website2.me Or his blog> https://supremespellcast.blogspot.com

    ReplyDelete
  10. My name is SHERRY WALJER from USA Massachusetts, i want to testify to the general public how my relationship was restored back by the great power's of Dr Larry after three months of loneliness, my ex-lover called me after my contact with Dr Larry that he want us to come back and start a good home, now we are happily together again as lovers. All thanks to Dr Larry who did a love spell for me for my ex lover to return home. I will keep sharing this until people who also need help see this for his wonderful help. You can contact him on his via email assurancesolutionhome@gmail.com or whatsapp him on +1(424)-261-8520.
    https://assurancesolutionhome.blogspot.com

    ReplyDelete
  11. REAL ONLINE LOVE SPELL CASTER THAT BROUGHT BACK MY EX LOVER YOU CAN EMAIL HIM on supernaturalspell@yahoo.com or whatsapp him +2348124644470
    Hello everyone i know there is someone somewhere reading this,My name is lisa donna from USA,I want to share a great work of a spell caster called PRIEST WISDOM my husband and i had a fight which led to our divorce but when he left me a part of me left with him and i was to sad and cried all day and night i was searching something online when i saw people testifying about his great work and i just decided to give him a try i did everything he told me to do and he assured me that after 24 hours my husband will come back to me,the next morning to my greatest surprised a car stopped outside my house and it was my husband i'm so happy he can also help you email him at supernaturalspell@yahoo.com or whatsapp him +2348124644470 ... OR VIEW THIS https://lettalaabourtrelationship.blogspot.com

    ReplyDelete