Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Faking Twitter unfurling to phish you

harrydenley.com

Post reply on HN
Print view View original

11–20 of 70 posts

Re: Faking Twitter unfurling to phish you

#11

Post by notatoad »

reginold wrote: post #3

Is there any sort of within-a-page HTTPS "secured" function? Like how banks have that "only type your password if we show your correct profile picture". Almost like if embedded tweets could be "signed" by twitter in a way that would register in my browser in a graphical way that would not be known to the server itself (ie putting the twitter logo next to a tweet is easily faked). But if content appearing to be from t…

signed web bundles [1] let you package up a page as a fixed resource, distributed with a signature to verify that the content of that page is what the author intended it to be, so a site like twitter that is embedding it can be sure that what they're embedding is always the original resource.

however, this is part of AMP, and so web developers who prefer the "do whatever the fuck you want" aspect of the internet push back against it. the ability to ensure that a web link contains the same content at a future date as it did when it was initially crawled was one of the things we destroyed along with AMP.

[1] https://github.com/WICG/webpackage

Re: Faking Twitter unfurling to phish you

#14

Post by animal_spirits »

seoulmetro wrote: post #13

This is pretty dumb. It's like writing `[google.com](notgoogle.com)` and making out like its a significant security flaw or new idea.

This is actually quite more complicated. Your webbrowser (firefox does, at least) will show you the destination link if you hover over any link element. In the case on the article, the destination link is exactly how it is written. So how can we now trust that twitter's shortening links only go to twitter?

Re: Faking Twitter unfurling to phish you

#15

Post by Thorrez »

recursive wrote: post #12

Ok, but what's unfurling? As far as I can tell, this is just tricking the thing that tells you the target domain of a shortened link? But if you clicked the link, you could just see the link though right. How is this fooling anyone?

> Ok, but what's unfurling?

I've never heard the term before now, but I interpreted it to mean following redirects to get the end page.

> But if you clicked the link, you could just see the link though right. How is this fooling anyone?

It fools you before you click the link. After you do, you're no longer fooled, as long as you pay attention to the URL bar. The obvious problem is people who don't pay attention the the URL bar.

Another problem might be you're forbidden from viewing certain sites at work, you see a link that goes to news.ycombinator.com knowing that's safe, but then go to a forbidden site instead.

Another problem would be browser 0-days. A link to news.ycombinator.com would be safe assuming it hasn't been compromised itself, but a different website might spring a browser 0-day on you.

Re: Faking Twitter unfurling to phish you

#16

Post by rvz »

Retr0id wrote: post #7

Firefox is doing a horrendous job of rendering the text on this site for me, on Arch Linux. Is it just me? https://i.imgur.com/ZP9wC85.png

Given that you're using a version of Arch Linux, Firefox and focusing on one particular site, It's probably only just you.

Re: Faking Twitter unfurling to phish you

#17

Post by wereHamster »

recursive wrote: post #12

Ok, but what's unfurling? As far as I can tell, this is just tricking the thing that tells you the target domain of a shortened link? But if you clicked the link, you could just see the link though right. How is this fooling anyone?

Unfurling is the process of fetching additional information (title, description, image) and showing that on the platform itself. Twitter does it, Facebook, Slack too.

On Slack you can implement custom unfurling that does more than just show the title/description/image. See docs here: https://api.slack.com/reference/messaging/link-unfurling. I'm currently building one such custom integration

Re: Faking Twitter unfurling to phish you

#18

Post by gitgud »

Not really a logical phishing strategy, if the first domain looks safe and the attacker controls it, why wouldn't they just use that to serve a phishing page? Instead of needlessly redirecting...

A better example would be to show "google.com" and somehow redirect to "phishing.com"... but that's not really possible without control of "google.com"

Re: Faking Twitter unfurling to phish you

#19

Post by lmm »

reginold wrote: post #3

Is there any sort of within-a-page HTTPS "secured" function? Like how banks have that "only type your password if we show your correct profile picture". Almost like if embedded tweets could be "signed" by twitter in a way that would register in my browser in a graphical way that would not be known to the server itself (ie putting the twitter logo next to a tweet is easily faked). But if content appearing to be from t…

I think it's difficult-to-impossible to do anything secure within a page, because a malicious page can emulate virtually any kind of behaviour within the page. https://textslashplain.com/2017/01/14/the-line-of-death/

(For example, if you had some sort of "signed iframe", the page would probably find a way to show the part from twitter that says "verified" but cover up the part that it's supposed to be actually verifying with something else).

Re: Faking Twitter unfurling to phish you

#20

Post by voussoir »

gitgud wrote: post #18

Not really a logical phishing strategy, if the first domain looks safe and the attacker controls it, why wouldn't they just use that to serve a phishing page? Instead of needlessly redirecting... A better example would be to show "google.com" and somehow redirect to "phishing.com"... but that's not really possible without control of "google.com"

I don't agree with your analysis. There are three domains at play: twitter-unfurl-faker.herokuapp.com, uniswap.org, and harrydenly.com. The first is the real link, the second is what Twitter's link previewer gets redirected to, and the third is where the user gets redirected to.

It seems to me that the author does not need control over the second domain, just the first and third. But the user will never see the first URL, only the second.

Post reply on HN