2 friends of mine have sent me very suspicious links on facebook, which ask me for credentials on an external site. Entering [email protected]
in the username, and 1234
for the password let me in, and redirect me to some car specifications, even though the post said that it was a video.
I accessed this through a phone, and chrome extensions don't apply there AFAIK, am I safe?
I have seen previous questions on SE which suggest that it is possible to buffer overflow an image with metadata, that gets executed with some memory address trick (the question can be found at: Can you get a trojan in an image file?). Could something similar apply to browsers and links?
Apart from that, it could just be any old phishing attack, but alot of people posted the exact same link on FB. A friend had reportedly recieved the same link from his relatives. Does anyone know the origin of this?
UPDATE: Decided to view page's Javascript with TOR (Noscript of course). I will pastebin the deobf code. Its full of obfuscation, and written in 1 line, making it time-consuming to space apart. Also, the title, and some JS is written in things like ส
, etc.
I am posting the link here if someone recognizes it, but PLEASE don't access it.
hxxp://ngovanhungxyz1.com/linhdeptraina/vipcute/chat/?utm_source=Facebook&utm_medium=X%C3%A3%20h%E1%BB%99i
A screenshot of the page looks like this:
It is full of badly translated Czech, and notice some untranslated segments at the bottom too. The header is completely missing content too.
utm_medium=X%C3%A3%20h%E1%BB%99i
. This is interesting. When you decode the url parameter it becomes this:Xã hội
. I recognize this as Vietnamese but I don't speak it. Google translate says this is similar to "Society"fbstatic-a.akamaihd.net
. I am currently deobfuscating javascript in lists. I will come with the output. Accessing through TOR and noscript of course, I dont wanna get hacked