0

2 friends of mine have sent me very suspicious links on facebook, which ask me for credentials on an external site. Entering [email protected] in the username, and 1234 for the password let me in, and redirect me to some car specifications, even though the post said that it was a video.

I accessed this through a phone, and chrome extensions don't apply there AFAIK, am I safe?

I have seen previous questions on SE which suggest that it is possible to buffer overflow an image with metadata, that gets executed with some memory address trick (the question can be found at: Can you get a trojan in an image file?). Could something similar apply to browsers and links?

Apart from that, it could just be any old phishing attack, but alot of people posted the exact same link on FB. A friend had reportedly recieved the same link from his relatives. Does anyone know the origin of this?

UPDATE: Decided to view page's Javascript with TOR (Noscript of course). I will pastebin the deobf code. Its full of obfuscation, and written in 1 line, making it time-consuming to space apart. Also, the title, and some JS is written in things like &#3626, etc.

I am posting the link here if someone recognizes it, but PLEASE don't access it.

hxxp://ngovanhungxyz1.com/linhdeptraina/vipcute/chat/?utm_source=Facebook&utm_medium=X%C3%A3%20h%E1%BB%99i

A screenshot of the page looks like this: enter image description here

It is full of badly translated Czech, and notice some untranslated segments at the bottom too. The header is completely missing content too.

Improve this question
8
  • utm_medium=X%C3%A3%20h%E1%BB%99i. This is interesting. When you decode the url parameter it becomes this: Xã hội. I recognize this as Vietnamese but I don't speak it. Google translate says this is similar to "Society"
    – d0nut
    Mar 28, 2016 at 17:03
  • 1
    @iismathwizard It is Vietnamese. The HTML and the login page suggests it. Me and my friends are Czech, so the page contains some badly translated Czech, and some untranslated Vietnamese. There is an icon link to fbstatic-a.akamaihd.net. I am currently deobfuscating javascript in lists. I will come with the output. Accessing through TOR and noscript of course, I dont wanna get hacked
    – John K
    Mar 28, 2016 at 17:04
  • Im avoiding opening any suspicious links while i'm at work so I didn't see the page and know it was vietnamese :p
    – d0nut
    Mar 28, 2016 at 17:05
  • 3
    Oh this is just a phishing scam. Nothing new.
    – d0nut
    Mar 28, 2016 at 17:09
  • 4
    Simple: someone who doesn't know better "signs in" to this fake facebook login page. They lose their account and the attacker signs in and sends the link to all of their friends. Coming from a trustworthy source, some of those users will log in. Rinse and repeat. Your friend's relatives might have signed in.
    – d0nut
    Mar 28, 2016 at 17:11

1 Answer 1

Reset to default
3

This is a textbook phishing attempt. A phishing attack consists of sending a user to a page that looks like the service they use in an attempt to get their login credentials or other sensitive information. Notice the domain name is not facebook.com. Normally they try to fake this or use domains that look like facebook.com such as faceb0ok.com or facebook.s0a.com. But you could do it with any domain. They likely chose this one to get around Facebook's URL filters.

If you have logged in here immediately log on to the real Facebook and change your login details and security questions. Additionally you likely got this link from someone that submitted their information. So should check and make sure your Facebook account didn't distribute these links as well.

Even worse, if your Facebook's username and password matches your email's. Change those immediately or they could gain access to much more than your Facebook.

Improve this answer
4
  • An additional point to make: I did a phishing test about 2 hours ago. I entered fake credentials like [email protected], and it let me through, so I knew to watch out. Seems that it upon someone being baited, their account sends automated messages with this phishing link. It's full of bad grammar, and weird spaces, and every account taken over has the exact same message
    – John K
    Mar 28, 2016 at 17:41
  • 1
    If you were already logged on (sending this link to you on Facebook they assume you are), all they would have to do is redirect you to facebook.com after stealing your credentials.
    – Bacon Brad
    Mar 28, 2016 at 17:45
  • I am aware. But upon entering false credentials, it redirected me to some car specifications website, so I doubt that the attacker intended to redirect back to facebook
    – John K
    Mar 28, 2016 at 17:46
  • They could do a POST to Facebook's login script with the information you gave. Which would log you in without issue if the developer didn't implement anything to combat CSRF (Cross-Site Request Forgery) or exploit something in their APIs. Facebook however does try to combat this. Regardless of how it logged you in, the site is faker than a 3 dollar bill and is meant to steal your data.
    – Bacon Brad
    Mar 28, 2016 at 17:52

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .