Lets say I was foolish enough to press on a YouTube video on Facebook that ended up being what I suspect is a phishing link. What can they potentially get?

I had three tabs open: (1) my phpMyAdmin control panel, (2) another random site logged in, and (3) the Facebook session which I navigated away from when I clicked the link.

  1. Should I be worried about the script having picked up cookie information from either of the first two tabs?

  2. They can't get session data because that is stored on the server, not the client right? If I understand correctly, the best they could do is get the session id that is stored in a cookie and then try to use my session id as an imposter.

  3. Lets say like I had a gmail session on tab 3 before going to Facebook, is the gmail session compromised now?


Phishing is a way to collect your private information, usually site username/password, but also sometimes your CC info.

Did you type any of this on the page that you were send to from Facebook?

If not - it's not phishing.

It can be "click jacking" or, most likely, they tried to install something on your computer.

From their site an attacker can't access SessionID/cookie of other sites (unless it has some vulnerability)

  • 1
    Phishing isn't just about getting someone to fill out a web form. It's about getting a few people to do something you want them to do, by trying a scam against a whole lot of people. This may include having them visit a malicious website that hosts a drive-by download, or simply acting on an e-mail in a way that verifies the address' validity.
    – Iszi
    Feb 5 '12 at 18:21
  • 1
    @Iszi - not true. See the definition in Wikipedia, for example.
    – D.W.
    Apr 17 '12 at 20:02

A phishing attack is one where a malicious web site tries to fool you into typing confidential information into the web page, and thus disclosing it to the attacker. They might try to get you to enter usernames, passwords, credit card numbers, SSNs, bank account numbers, or any variety of other personal details. If you didn't type anything into that web page, you are safe from phishing.

It still might have been some other sort of attack, e.g., a drive-by download (where the website tries to exploit some vulnerability in your browser), a social engineering attack (where the website tries to trick you into installing some software), a clickjacking attack (where the website tries to trick you into clicking on something, which the browser interprets differently than you intended), or something else.

If you are running a fully up-to-date version of your browser and associated software (Flash, PDF viewers, Java, Quicktime, etc.), then you probably are relatively safe from drive-by downloads. If you want to check whether your software is up-to-date and fully patched, download Secunia PSI; it is great for this.

As far as social engineering attacks, if you didn't click OK on any dialog boxes, you're probably OK there. You probably don't have to worry about clickjacking attacks: that is the responsibility of the websites who would be affected, and most major websites protect their users.

If you are very concerned, you can always change your password for Facebook, Gmail, and your local web site. However, personally I wouldn't bother unless I had some reason to believe that one of the above attacks might have been successful.

  • One attack you missed is the browser fingerprinting. The actual attack might come later after the attacker fingerprint the browser and all the installed extensions. panopticlick.eff.org
    – void_in
    Nov 3 '13 at 6:50

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.