3

A lot of bots are sending this link to me on twitter, and obviously it must be something malicious. Can someone explain in a detailed manner that what does this link do and what is the vulnerability here?

This is the link:

enter image description here

It sets up and sends some variables to youtube then logs me out and then sends me to a bitly shortened link: hxxp://bitly.com/2vK4Fga#1007310965585731584

I unshortened it and it came back with this : 

hxxps://www.baidu.com/link?url=rZncHEMCsf6lt8ulV0jdARLcZOqlmQgim4767m7Jgya&wd=&eqid=c152d8470000dc7c000000065b734ee3

The site is a Chinese search engine! When I clicked on this link on my VM, it went to this website: hxxp://www.twitob.com/ which is some sort of gaining twitter follower site.

What is this link doing? I get that its setting some variables like ilo or ils and stuff, but I don't know what are they and why set them to these specific values? What are these variables?

I also found a report on a similar thing to this :

hxxps://www.openbugbounty.org/reports/222365/

but not sure if they are the same vulnerability or not, and that report doesn't explain anything.

One more weird thing is that usually I can easily unshorten the twitter's t.co links, but when I unshorten the t.co link that twitter gave me for these links, it turned into this no matter which website i used :

hxxps://www.google.com/url?sa=D&q=https://bitly.com/2vK4Fga&ust=1535028318764694&usg=AFQjCNF2RgdA4d9RaMK6foDsWn51_W3yYA

But you can clearly see that the actual link is something way different, what is going on?

Improve this question
6
  • Obfuscation? The more layers it have, the more difficult is to search engines and humans to detect what is going on.
    – ThoriumBR
    Aug 23, 2018 at 13:06
  • The variables in the links are up to each service. You would have to know what the service uses those variables for.
    – schroeder ♦
    Aug 23, 2018 at 13:29
  • @schroeder so how can i know? people who made this link obviously knew, but how did they know and why they are setting them to these specific values?
    – AlenT
    Aug 23, 2018 at 13:52
  • It could be as simple as looking at the requests back and forth from the service and playing with the variables.
    – schroeder ♦
    Aug 23, 2018 at 14:19
  • 1
    For example, gmail used to have a variable called shva=1 which meant "should have validated already"
    – schroeder ♦
    Aug 23, 2018 at 14:26

1 Answer 1

Reset to default
3

I'm not going to click on that URL but what it appears to do is:

  • You can only see the beginning, it looks OK and possibly important to you.

  • If you don't examine the remainder of the URL it seems safe to click on.

  • When you click on it you are redirected to Google and logout.

  • Next you are redirected to a BitLy URL shortener.

  • The BitLy redirects you to the Baidu search engine.

  • The Baidu URL has an "Associate ID" attached.

  • You could be directed to a previously saved search, and the associate gets credited.

  • IF any of the subsequent sites you see are malicious then since you are logged out of Google (and thus YouTube too) they probably will ask for your name and password, offering to log you back in. The chances of the page asking for your password being a fake Google login webpage are very good.

ALWAYS enable 2-Step Authentication !

Once you give your Google account away they can use it to upvote their favourites and make posts that seem to come from you. Even if you don't give out your password the Associate still gets a credit for your click-through.

So, it may or may not be "malicious" (lead to something "harmful") but it certainly gives someone credit for your click.

This (in its various forms) is explained here: "From Baidu to Google’s Open Redirects", here "How Malware Campaigns Employ Google Redirects and Analytics" or here, on a Google Support webpage: "Detect and get rid of unwanted sneaky mobile redirects".

If you don't have a good reason to click on something don't click on it - it's going to take you off of the page you are on.

Improve this answer
2
  • But as i said it doesn't seem to be a phishing thing, i opened the baidu link in my VM and it sends me to a twitter follower type of page, but i don't understand whats the deal with those youtube variables and why log me out then? and why even use that search engine website to send me to the final link and why not just send me there, or maybe it would do a different thing if i use my actual browser since its already logged in, and i have to mention i didn't open the full link, just the bitly part
    – AlenT
    Aug 23, 2018 at 13:02
  • It doesn't have to fish you immediately, it can wait, minutes later you may be less suspicious. The YouTube variables are to legitimatize the URL (unless you scroll to the end and see what's going on). Using a trusted site at the beginning makes it seem acceptable. If you report it to Facebook they will know to look for the text at the end of the URL. If you report it to Google they can remove redirects to there. As long as you click the associate gets a penny, what happens after they could probably care less.
    – Rob
    Aug 23, 2018 at 13:09

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .