Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

There is a special Facebook link that will redirect anyone who clicks it to their own Facebook profile they are currently logged in on on their browser. The link goes like this: http://www.facebook.com/profile.php?=743264506 (the link is harmless by the way, you can Google it if you are unsure)

I had some suspicion that this could be used for revealing identity of a person just by sending them a specially crafted link. I am not a programmer, but this is what I thought:

  1. Create a website that you link to the person you want to reveal the identity of.
  2. The website contains some clever redirect or parsing script that sucks in the data from this special Facebook link, and then sends it back to the server (attacker).

Is this technically possible?

share|improve this question
1  
The reason this link works is because you have cookies on your computer telling Facebook which account you want. The proxy website will not have these cookies and Facebook will not know what to give it, thereby returning a login page. –  Thomas Oct 10 '12 at 20:19
add comment

3 Answers

up vote 2 down vote accepted

The short answer is no, this will not work the way you intend it.

To understand why, you first need to understand how Facebook gets you to the correct profile. In the client's browser are cookies which Facebook uses to recognize their account. So, when the client visits the link, Facebook reads the cookies on the client's browser and takes them to the correct profile page.

Fortunately for us, cookies are only available to the issuing domain. This means when the user visits your hypothetical phishing page, the malicious page would be unable to read your Facebook cookie.

share|improve this answer
add comment

No, this isn't possible. Otherwise https://facebook.com would also reveal your identity: it opens a page with your name on it and everything from your stream.

What you are thinking about can be done with a cross-site scripting attack. This would inject a script into the page, which can do whatever it wants with the website. It can send info it gathered to the attacker, post messages for you, etc.

Facebook is not currently known to be vulnerable for cross-site scripting. It's very easy to patch this vulnerability, so if such a breach were found, it would be gone within an hour or two after discovery (pushing the update live takes a while). Meanwhile they could take that part of the website down.

For your reference, an example of an attack URL could be: https://example.com/search?q="><script src="attack.js"></script> To obscure this, an attacker would probably encode it:

https://example.com/search?q=%22%3e%3c%73%63%72%69%70%74%20%73%72%63%3d%22%61%74%74%61%63%6b%2e%6a%73%22%3e%3c%2f%73%63%72%69%70%74%3e

The only way this attack could be performed without Facebook themselves being vulnerable, is when the page is loaded over HTTP (not HTTPS) and an attacker can control the connection (like on a public WiFi network), or when you are using an old browser such as Internet Explorer 6. Or related things like Flash Player being very old, or you having a virus... But these are all external factors and not a vulnerability in the way that you described (finding an identity by a specially crafted url or page).

share|improve this answer
add comment

Contrary to the other answers, actually YES it is possible. However it is not actually so simple, and not exactly as you put it.

  1. Instead of directing your victim to a profile, you can send him to your Facebook app. Of course, this app needs to be registered as a valid facebook app, and etc.
  2. In the URL to your app, you can submit certain parameters - say, for example, the user's current session id on your own website.
  3. Note that this URL is directed to Facebook, and thus your FB cookie will be sent, since it is FB's servers; they then forward the request to your app.
  4. Your facebook app should be hosted on your own server, and this should be have some form of communication with your victimizing website, allowing a lookup between the Facebook identity and the session id.
  5. Thus, you just used Facebook as an unintentional identity provider.
  6. Using certain additional techniques, such as CSRF, you can send the user directly and automatically, simply by being on your site.
  7. Note, however, that this is actually not as simple as it once was, and here is where social engineering would come into play: Facebook now requires explicit user approval before allowing an app access to your details.
  8. On the other hand (and I admit I may be out of date on this - it is hard to keep up with Facebook's consistency) - there are some details that an app can recieve before even asking you to install it. (I'm not going in to all those technical details here, I think it's irrelevant at this point, and would probably be off topic. )

You can find more in depth details, including all the technical details, on this blog post from a few years ago; as I said, some of it may be out of date.
(Disclosure: I did assist in some of that research).

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.