Slashdot Mirror
Facebook's URL Scanner Vulnerable To Cloaking Attack
Facebook's recent move to scan for malicious URLs sounded like a pretty good idea, but itwbennett writes with word that it's already been bypassed.'Hatter,' a member of hacking think-tank Blackhat Academy, provided a live demonstration, which involved posting the URL to a JPEG file on a wall. Facebook crawled the URL and added a thumbnail image to the wall post, however, clicking on its corresponding link actually redirected users to YouTube. This happened because the destination page was able to identify Facebook's original request and served a JPEG file. Earlier this week, Facebook signed a partnership with Websense to use the security vendor's cloud-based, real-time Web scanner for malicious URL detection. Blackhat Academy has now provided proof-of-concept code, which, according to its advisory, can be used to bypass it."
Maybe Facebook should ask Slashdot what system they use, it seems to be working pretty well on your post.
Let me guess - you work as a web programmer for Facebook?
Those who can make you believe absurdities can make you commit atrocities. - Voltaire
Yes, they managed to get facebook to use their image for a thumbnail. That says absolutely nothing about their ability to detect malicious links. (Rickrolling is not considerered a malicious link in this context.) The request for the thumbnail probably originated from facebook's own servers. The malicious link detection is comes from other IP addresses. TFA explains this.
Guys, I've discovered that if you do
if ($certainUserAgent) {
print 'Something;
} else {
print 'Something else';
}
I'm going to start a security company, is anybody interested in hiring researchers for their operations. Corporate contracts start at $100,000.
You mean URL's can be verified, and then later have the indecency to point to something else?
Say it isn't so!
Slashdot's even been bitten by it a few times.
Do you even lift?
These aren't the 'roids you're looking for.
Well I hope TFA explains it better than TFS.
This happened because the destination page was able to identify Facebook's original request and served a JPEG file.
Lets see, click a thumbnail, got to the third party server, which does whatever the hell it wants to with your request. Welcome to the intertubes.
I also fail to see why this is a problem.
You can set the thumbnail with the "link rel='image_src'" tags!
Along with the title and description...
No need for any server side code; its all documented on OpenGraph.
Romulans!
But it's aliens.
Help stamp out iliturcy.
The trouble with "malicious URL scanners" that look for malware is that unless they're real-time, they're too late. The lifetime of bad sites is now often measured in hours.
Still, continually detecting the bad guys and beating on them does have effect. Major services have to do it, or they get pwned.
We do some tracking of major sites being exploited by phishers, There are only 29 sites on the list today, one of the shortest lists we've had in years. It's been as high as 140. The URL-shortening sites get hit daily, and kick most of the bad guys off within hours. The free-hosting sites get hit too, and most of them are good about kicking the phishers off. (Piczo and webs.com are not too good at this. t35 has gotten much better. Google has a big problem with people using documents and spreadsheets as phishing sites.)
Facebook should've constructed a comsat scanner, not a URL scanner.
Silly facebook.
How do you do that? I mean
posting the URL to a JPEG file
What do you have to do (and how)?
Don't be apathetic. Procrastinate!
A while back I actually wrote a tool for Rickrolling people several months ago:
http://brokenthings.org/
based on poisoned link redirection. It works well enough. The only way to avoid redirector tricks is to follow redirectors all the way to The Actual Page and then use *that* as the reference. Then, at least if the link is poisoned, it'll be obvious.
Interesting....
I was at a conference last week where the Facebook's malicious URL detection engine, which was stated by a Websense supplier as sourced by Facebook from Websense, was discussed. I remember using Websense years back as a URL filtering engine (which I believe it still is but with an improvement in deep inspection) and can see how Facebook have probably bolted it in so that traffic using redirects from their site get a layer of filtering before redirection from Websense's URL database and from the on the fly categorisation features, however, I can also see why there is still vulnerability. URL blockers, DPI engines and the like, like Websense, are tools that are always in development and are rarely anywhere near 100% accurate, instead, being aimed at giving an acceptable level of accuracy.
To be honest, I can't see that this vulnerability will be anywhere near the top of the list of vulnerabilities in tools like these. I'd be surprised if an unclassified (by the filtering engine) proxy couldn't redirect to wherever was required