Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

Today I read a post on a Facebook-group about a "problem" with links posted to Facebook.

Appearently when you post a link at Facebook, the sites goes through the redirect(s) that may be on the site which is linked to in the first place (link to phishers site --> redirect to legitimate site = facebook shows content of legitimate site).

If the owner of the first site afterwards remove the redirect, you will now have a link looking quite legitimate (depending on the site to which you redirect initially), but may be a scam phishing site!

I am far away from being deep into security matters, but this seems rather stupid to me and as a obvious problem with eg. contest pages or "Like if you also like turtles"-pages.

Why do Facebook have this "feature" and how could they eventually avoid it (updating link regularly or by request or similar)?

share|improve this question
1  
I'm having trouble understanding your question. Could you edit your post to give a clearer explanation of the issue, and an example? –  Polynomial Oct 25 '12 at 9:41
    
As a little extra, someone has made a tool which may also help to clarify how this "works": xfiles.creen.dk/redirect-once –  RasmusP_963 Oct 25 '12 at 21:07

1 Answer 1

I am not Facebook, but if I were designing their linking system my reasoning for following the links would be this:

  1. Shortlinking systems like bit.ly and tinyurl.com are ubiquitous.
  2. We need to follow the link to the end in order to scrape content from the page (images, blurb of text) to put in your feed, as well as to correlate you with others that have posted the same link.

Note that the problem here is not actually solvable: if the attacker has control of the original link--redirect or not--that link can be manipulated to look legitimate for Facebook's scrape, and then turned malicious afterwards.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.