serious security concern anyway!
Ok, journalist love to use strong words. So placing hijacking in title is right for trapping readers.
I'ts not really an hijacking as the link was present on victim website intentionally.
As some of this sites are securised, while facebook don't, I think there seem to be a trick to work around for finding something like a way to create a MITM be cross-site scripting. (Putting a trap page on facebook is trivial).
To be more explicit: If this case don't have a direct security implication, it reveal one possible way of doing something like:
- breaking facebook (certainly hard to do, but surely less than breaking the lot of banks who hold a facebook-i-Like button on website.)
- corrupting errors and redirections pages for redirecting to a pirate site in sending origin for good site template selection.
- spoofing design and look of asked site.
- collect victim password and initiate a MITM transaction corruption.
... In the hope, the victim (who have clicked on usual like or hited correctly URL in browser) will do his transaction without carefully re- read the URL bar of his browser...
But anyway, if you click an usual link, when you see the correct site coming, are you confident or did you do every time a URL bar check?
Nota: If well worked, I could figure a bot that do the job for point 2 and 3 ... and 4.
Remember: In this story, user did'nt click anywhere before redirection! According to my point of view, this is a serious security concern!
I think that site having real security concern (like banks) must whipe such kind of links out of their websites, until concern will be completely reviewed.