Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Faking Twitter unfurling to phish you

harrydenley.com

Post reply on HN
Print view View original

61–70 of 70 posts

Re: Faking Twitter unfurling to phish you

#61

Post by seoulmetro »

animal_spirits wrote: post #14
seoulmetro wrote: post #13

This is pretty dumb. It's like writing `[google.com](notgoogle.com)` and making out like its a significant security flaw or new idea.

This is actually quite more complicated. Your webbrowser (firefox does, at least) will show you the destination link if you hover over any link element. In the case on the article, the destination link is exactly how it is written. So how can we now trust that twitter's shortening links only go to twitter?

Isn't the destination link `t.co/XYZ` ?

That's what it has been for me in Facebook, Twitter, Instagram, etc. their own mangled URL. And no, I don't trust those either.

>So how can we now trust that twitter's shortening links only go to twitter?

They never did.

Edit: Just checked his example, and yes. It looks like the hover link is still a random garbled `t.co/XYZ` and not `uniswap.org`. I'm still right and it's still pretty dumb.

Re: Faking Twitter unfurling to phish you

#62

Post by seoulmetro »

pyrolistical wrote: post #58

This doesn’t make sense. Why doesn’t the Twitter bot serve the final site location after following all the redirects. Then since the bot sees the correct site it redirects to the correct site

Because you can make a bot do what you want and a non-bot do something else.

Re: Faking Twitter unfurling to phish you

#63

Post by [deleted] »

seoulmetro wrote: post #61
animal_spirits wrote: post #14

Earlier quoted context omitted.

This is actually quite more complicated. Your webbrowser (firefox does, at least) will show you the destination link if you hover over any link element. In the case on the article, the destination link is exactly how it is written. So how can we now trust that twitter's shortening links only go to twitter?

Isn't the destination link `t.co/XYZ` ? That's what it has been for me in Facebook, Twitter, Instagram, etc. their own mangled URL. And no, I don't trust those either. >So how can we now trust that twitter's shortening links only go to twitter? They never did. Edit: Just checked his example, and yes. It looks like the hover link is still a random garbled `t.co/XYZ` and not `uniswap.org`. I'm still right and it's stil…

[deleted]

Re: Faking Twitter unfurling to phish you

#64

Post by folmar »

thaumasiotes wrote: post #46
phsau wrote: post #36

Earlier quoted context omitted.

Isnt't that what CORS/same-origin policies prevent? The attacker domain can be prevented from loading the bank resources within the same context by the browser. If the request is made by the attacker domain instead and proxied to you, then it doesn't have your cookies to display the private identification. In either case, the "correct profile picture" would not load.

> If the request is made by the attacker domain instead and proxied to you, then it doesn't have your cookies to display the private identification. Why is that a concern? You try to log in on a phishing site. The phishing site tries to log in as you at your bank's actual website. Your bank sends the phishing site your picture. The phishing site displays your picture to you.

The bank can and will use quite sophisticated request flow analysis to prevent one party from making too many attempts, so this means an attacker must grab a botnet or similar and be careful to avoid detection.

Re: Faking Twitter unfurling to phish you

#65

Post by jcpham2 »

jabiko wrote: post #39
omegalulw wrote: post #32

Earlier quoted context omitted.

> and no, you can't just whitelist them because some companies uses their own different shortlinks like t.co, fb.me, g.co, msft.it, redd.it, and youtu.be It won't be terribly hard to build a top 50 list of url shorteners etc that cover the vast majority of the traffic.

I think some URL shorteners allow editing the URL after creating a short link. So you are back to square one

If it stores the short link and destination url in a database that can be modified, yes.

Re: Faking Twitter unfurling to phish you

#66

Post by lmm »

reginold wrote: post #60
lmm wrote: post #38

Earlier quoted context omitted.

> That way the server doesn't know what the "verified" image actually looks like. Right, but it doesn't need to - it just has to construct a page that has the "verified" image on the left and the malicious URL on the right. Which is very difficult to rule out.

How would it construct a page that has the verified image if it doesn't know what the image looks like?

It would construct a page that includes a part that's genuinely verified (so the browser displays the verified image) and a part that's malicious, but arrange it so that it looks like the verification goes with the malicious part.

Re: Faking Twitter unfurling to phish you

#67

Post by Thorrez »

manmal wrote: post #24
Thorrez wrote: post #5

Why does this require the extra step of using a burner account? Why not tweet https://twitter-unfurl-faker.herokuapp.com/ from your main account and that's it? Does Twitter only unfurl t.co URLs? If so, why would they write separate code for unfurling t.co with ?amp=1 vs without ?amp=1 ? And why would Twitter unfurl a t.co link past the first non-t.co URL? I guess that's the vuln, right, that they don't stop after th…

Sometimes, t.co links redirect 5+ times until the target domain is reached, so I guess fixing this would break a lot of twitter‘s content.

You mean they redirect through various different domains not affiliated with Twitter before reaching the end? Who creates these links? Is it people creating short links before posting to twitter? What's the purpose? Just tracking?

Re: Faking Twitter unfurling to phish you

#68

Post by manmal »

Thorrez wrote: post #67
manmal wrote: post #24

Earlier quoted context omitted.

Sometimes, t.co links redirect 5+ times until the target domain is reached, so I guess fixing this would break a lot of twitter‘s content.

You mean they redirect through various different domains not affiliated with Twitter before reaching the end? Who creates these links? Is it people creating short links before posting to twitter? What's the purpose? Just tracking?

Yes, my bet is on tracking.

Re: Faking Twitter unfurling to phish you

#69

Post by Thorrez »

manmal wrote: post #68
Thorrez wrote: post #67

Earlier quoted context omitted.

You mean they redirect through various different domains not affiliated with Twitter before reaching the end? Who creates these links? Is it people creating short links before posting to twitter? What's the purpose? Just tracking?

Yes, my bet is on tracking.

Wait, my original question still is open. "Why not tweet https://twitter-unfurl-faker.herokuapp.com/"? If Twitter won't unfurl non-t.co URLs, then that "would break a lot of twitter‘s content."

Re: Faking Twitter unfurling to phish you

#70

Post by Sophira »

dpwm wrote: post #34
eyelidlessness wrote: post #26

Earlier quoted context omitted.

Also this is much less sophisticated than fooling curl | sh, but people continue to insist that’s perfectly fine.

I don’t think I’ve seen anybody insist curl | sh is fine from untrusted sources. In many contexts, curl | sh is an alternative to adding some kind of additional repository to install a third party package — and in most package managers this is done as root anyway, with arbitrary pre-install and post-install scripts. I’m not really sold on how curl | sh (with https) is any less secure than blindly following steps to a…

I have seen plenty of curl | sh invocations that pass the "-k" flag to curl, meaning that curl will allow insecure connections even if there are invalid SSL/TLS certificates.
Post reply on HN