3

I received one of those obvious fake "is this you?" and some fake Youtube link on Facebook Messenger. I don't know what it redirected to as I didn't click it (I only hovered over it to see if it was a legit Youtube URL, which it wasn't)

Am I safe as I only read the message and didn't click the link or view it on any of my devices, or would it be possible for me to get malware just by viewing the Facebook message itself?

2

You are probably safe if these are true:

  1. You didn't click the link*
  2. Your browser is updated with the latest patches**
  3. You aren't using any chrome or browser extensions***
  4. Your computer is updated with the latest OS patches****

Generally, most exploits utilize well known vulnerabilities in common software like your browser, operating system, popular extensions, and common platforms. Vulnerabilities that are not well known are typically called zero-days. They cost (or sell for) a lot of money, and most people won't waste them on normal people. Nation states will buy them and use them to spy on other countries.

So, for most of us, keeping our software up to date is enough.

(*) it is possible that simply loading a message can kick off a CSRF and access other services that you use. If this was a common attack, your platform would be well known for allowing them. And so would the other site that let the CSRF through. Therefore, unlikely. Clicking a link can kick off more actions, like loading a malicious page. But even that is unlikely to affect you assume the other 3 things are in place.

(**) Your browser is your first line of defense. Keep it up to date.

(***) Browser extensions can break your browser's security model and allow attacks through. Only use them from trusted developers, or just don't use them unless you have to.

(****) Your last line of defense is your OS. Some browser exploits break out of the browser's sandbox, then need to take advantage of a vulnerability on the operating system. If you've closed the well known ones, your in the unlikely camp again, because nobody is wasting a zero-day on you.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.