Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

Regarding to trusted sites like YouTube, should I trust other videos when embedded to Facebook, usually, when user shares a link a thumbnail image will be created and previewed, then, we need only to click on Play icon (Or the thumbnail) to play the image.

Is there any risk behind that? Considering an attacker can bypass Facebook security and adds fake video so that when user clicks on it will be redirected to Malware download.

share|improve this question

1 Answer 1

up vote 5 down vote accepted

Facebook embeds videos in the News Feed and Timeline by using previous knowledge of the way each site supports embedding videos. That means Facebook tries to "understand" the page to which you're linking, and then attempts to embed it; the user doesn't actually control how the embedding happens, ie. when you see an embedded video on Facebook, you can be sure it's embedded in the way Facebook intends it to be embedded.

The key here is know to where the link is leading: Notice in the domain name in this Facebook post

fb_yt_link

That field cannot be manipulated by the poster without actually changing the domain to which the link is leading. So unless you're being MiTMed, when you see a video embedded that way in Facebook, and you see www.youtube.com as the target domain, then you can be relatively sure that clicking the thumbnail will load the genuine content from YouTube. Same goes for other video providers (Vimeo, DailyMotion, etc.)

However, beware of the rouge Facebook apps that are able to embed videos and trick you into installing malware after you click on the thumbnail. You'll notice that app-embedded videos don't have that domain field.

In any case, app or not, video or not, always be cautious whenever you click on anything

Update: I've just noticed a different Facebook behaviour which is also legitimate and it doesn't involve the domain field mentioned earlier.

Sometimes when the video is shared from within YouTube to your Facebook account, the domain field will not appear in the post, but it will explicitly say "Via YouTube". So also watch for this, it can also be "Via DailyMotion", or "Via Vimeo", etc.

fb_yt_link_2

share|improve this answer
    
Adnan, consider your scenario but with different domain, user might embed a link from any domain, my concern here is about Facebook, do you ever saw any video that redirected you to malware download? if yes, it means that Facebook filter can be bypassed... –  Akam Jul 22 '13 at 1:14
1  
As Adnan said, Facebook won't let you embed a video from any random domain. It only embeds videos from domains Faceboook already knows about, sites that it trusts not to host malware. –  John Deters Jul 22 '13 at 1:33
2  
@Akam It is possible to make a Facebook post that looks like an embedded video by linking to a malware page and assigning the thumbnail as a photo with that video triangle icon. In that case, you'll notice that the domain is not one of a known video site (YouTube, DailyMotion, MetaCafe, etc.). Yes I have seen videos linking to malware, but like I said they're embedded using rouge Facebook apps. It's so easy to spot those as they don't contain the correct domain field and they usually ask you to give them many permissions. –  Adnan Jul 22 '13 at 6:58
    
As the popular "Via Microwave" app shows, it's possible to spoof the "Via X" line. So I wouldn't rely on that alone. –  Yamikuronue Aug 15 '13 at 20:38

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.