Slashdot Mirror
Facebook's URL Scanner Vulnerable To Cloaking Attack
Facebook's recent move to scan for malicious URLs sounded like a pretty good idea, but itwbennett writes with word that it's already been bypassed.'Hatter,' a member of hacking think-tank Blackhat Academy, provided a live demonstration, which involved posting the URL to a JPEG file on a wall. Facebook crawled the URL and added a thumbnail image to the wall post, however, clicking on its corresponding link actually redirected users to YouTube. This happened because the destination page was able to identify Facebook's original request and served a JPEG file. Earlier this week, Facebook signed a partnership with Websense to use the security vendor's cloud-based, real-time Web scanner for malicious URL detection. Blackhat Academy has now provided proof-of-concept code, which, according to its advisory, can be used to bypass it."
How's this for a malicious link?
We get it: Malice always trumps good intentions. Is anyone here actually surprised? Who hasn't seen hotlink detection in action? That was common 10 years ago. This isn't new. It's just a new form of malice.
Come on editors; it's like you're not even trying anymore. Tell us something we don't all already know.
Yes, they managed to get facebook to use their image for a thumbnail. That says absolutely nothing about their ability to detect malicious links. (Rickrolling is not considerered a malicious link in this context.) The request for the thumbnail probably originated from facebook's own servers. The malicious link detection is comes from other IP addresses. TFA explains this.
All links are considered malicious! And it says that facebook recommends you not to follow it. Even the most serious Norwegian web sites, government included.
Guys, I've discovered that if you do
if ($certainUserAgent) {
print 'Something;
} else {
print 'Something else';
}
I'm going to start a security company, is anybody interested in hiring researchers for their operations. Corporate contracts start at $100,000.
You mean URL's can be verified, and then later have the indecency to point to something else?
Say it isn't so!
Of course this is nothing surprising, or even new. There are only a few reasons you'd implement something this lame and call it a security enhancement. Money is one, and that explains Websense's motives. Lack of a proper clue is another, which goes nicely with Facebook's history. In Facebook's case, it may even be willful neglect. It's hard to believe that among all the developers at Facebook, they are all this dumb. How about it, Facebook technical staff? Were you even consulted on this? There again, it's hard to imagine competent techincal staff going along with some of the other horrors that have already been rolled out by Facebook too.
Seriously, there's a lot of money to be made here. And if you can sell snake oil as a cure-all, you'll rake some in. That likely applies to both Facebook and Websense.
I can only hope that the unwashed masses (which includes a fair number of /. devotees) wake up to the privacy implications of Twitbook-like sites soon because I'm sick of seeing their icons on nearly every web page. And that includes yours, /. Be among the first and remove that crap, please?
Find or generate useful content (blog post, infographic, anything) relevant to the article at hand, host it on your own server, linkn to it in a post made within the first 5 minutes so it gets modded +3 informative or better, then replace it with hello.jpg. Isn't this one of the oldest tricks in the book, with only minor modification (changing the criteria for deciding which content to show from strictly time-based to the source IP and/or request headers?
I mean, I guess another demonstration never hurts, especially considering many people on the internet have never seen a goatse troll, and might not even know what one is... but I sure hope it's not "news" to anyone on /.
Well I hope TFA explains it better than TFS.
This happened because the destination page was able to identify Facebook's original request and served a JPEG file.
Lets see, click a thumbnail, got to the third party server, which does whatever the hell it wants to with your request. Welcome to the intertubes.
I also fail to see why this is a problem.
You can set the thumbnail with the "link rel='image_src'" tags!
Along with the title and description...
No need for any server side code; its all documented on OpenGraph.
Romulans!
But it's aliens.
Help stamp out iliturcy.
The trouble with "malicious URL scanners" that look for malware is that unless they're real-time, they're too late. The lifetime of bad sites is now often measured in hours.
Still, continually detecting the bad guys and beating on them does have effect. Major services have to do it, or they get pwned.
We do some tracking of major sites being exploited by phishers, There are only 29 sites on the list today, one of the shortest lists we've had in years. It's been as high as 140. The URL-shortening sites get hit daily, and kick most of the bad guys off within hours. The free-hosting sites get hit too, and most of them are good about kicking the phishers off. (Piczo and webs.com are not too good at this. t35 has gotten much better. Google has a big problem with people using documents and spreadsheets as phishing sites.)
Facebook should've constructed a comsat scanner, not a URL scanner.
Silly facebook.
How do you do that? I mean
posting the URL to a JPEG file
What do you have to do (and how)?
Don't be apathetic. Procrastinate!
A while back I actually wrote a tool for Rickrolling people several months ago:
http://brokenthings.org/
based on poisoned link redirection. It works well enough. The only way to avoid redirector tricks is to follow redirectors all the way to The Actual Page and then use *that* as the reference. Then, at least if the link is poisoned, it'll be obvious.
Interesting....
I was at a conference last week where the Facebook's malicious URL detection engine, which was stated by a Websense supplier as sourced by Facebook from Websense, was discussed. I remember using Websense years back as a URL filtering engine (which I believe it still is but with an improvement in deep inspection) and can see how Facebook have probably bolted it in so that traffic using redirects from their site get a layer of filtering before redirection from Websense's URL database and from the on the fly categorisation features, however, I can also see why there is still vulnerability. URL blockers, DPI engines and the like, like Websense, are tools that are always in development and are rarely anywhere near 100% accurate, instead, being aimed at giving an acceptable level of accuracy.
To be honest, I can't see that this vulnerability will be anywhere near the top of the list of vulnerabilities in tools like these. I'd be surprised if an unclassified (by the filtering engine) proxy couldn't redirect to wherever was required