2

I received a message from a friend with a link. I never clicked it, but the thumbnail image shown pretended to be an image preview for a YouTube video. Some of her other friends clicked it and it took them to a fake Facebook page where it asked them for username and password.

I always would prefer to disable such link previews as you can in Safari on iPhone, but sadly in Messenger there is no such option. Obviously images can contain malware and the fact an image displays means it has been processed by the Messenger app. What is the risk of malware from a URL preview image that has not been clicked? Just the preview that automatically displays in link shares?

I am not sure if these previews have risks such as steganography or pixel trackers linking to XSS attacks or any other risks?

2
  • 1
    these would be served from a server that scrapes the URL for content. I suppose the safety of the preview depends on the company doing the scraping.
    – pcalkins
    Oct 22 '20 at 23:16
  • When it comes to messenger link shares, I think users have to specify a URL to facebook for the preview image, I thought there was an actual tool developers used for that. To think that Malware can be shared in Messenger without even clicking a link is a scary thought.
    – Coderxyz
    Oct 22 '20 at 23:21
3

You have correctly identified the primary threat, which is social engineering. The image prompts the user to view what they believe is a harmless video, they're misdirected into a phishing scam.

There is another interesting threat I believe you've outlined quite well: an attacker crafts the contents of a website so that when processed by a thumbnail generator, the resulting image can cause arbitrary remote code execution on the end-user's device. While this attack sounds very interesting, and might be plausible, I would imagine that an attacker would be more interested in remote code execution on the Messenger platform. The thumbnail generating parser may be vulnerable to remote code execution on Messenger's servers. Even if the user does not engage the link/preview, the existence of this preview functionality increases the attack surface for malicious software. Should the thumbnail generating service be compromised, it follows that an attacker may then be able to provide arbitrary thumbnails, perhaps even arbitrary responses in the Messenger service. In other words, the presence of the feature puts Messenger at risk and therefore it puts end-users at risk.

As for the possibility of fuzzing the thumbnail generator or causing the generator to pass remote code execution exploitation within the image served by Messenger? I can imagine that it is a possibility, but I'm not certain. It seems to me that this would be computationally intensive, require privileged information about the thumbnail generator, and is an attack that would be very easy to spot in the wild. If I were threat modelling for the security considerations of installing the Messenger app, this particular attack would be lower priority.

1
  • Great answer. Keep in mind to get nice paragraphs you need to add two line breaks, else the system won't do anything.
    – MechMK1
    Oct 23 '20 at 14:20

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.