3

Recently I have received a link from one of my Skype contacts (infected by a computer virus).

The link looks like an Instagram one, but points to another site. How the attacker did this? How to create similar message?

Skype (version 7.7 (335)) message screenshot on Mac:

Hidden link in Skype on Mac

Update:

Some people think this question is not security-related. But I disagree.

This is unusual behavior of Skype. Skype users expect that link text is always equal to link target. Changed links may be used to send spam messages, malware distribution and users de-anonymization.

closed as off-topic by Xander, schroeder, Stephane, Iszi, Jeff Ferland Jul 8 '15 at 18:37

This question appears to be off-topic. The users who voted to close gave this specific reason:

  • "This question does not appear to be about Information security within the scope defined in the help center." – Xander, schroeder, Stephane, Iszi, Jeff Ferland
If this question can be reworded to fit the rules in the help center, please edit the question.

  • 4
    What version of Skype are you using? They could have done <a href="http://goo.gl/7kxyz">http://www.instagram.com/best/xyz</a> and pressed Ctlr + Shift then clicked send message. community.skype.com/t5/Windows-archive/… – hd. Jul 7 '15 at 11:31
  • Link text and link target are 2 different things. On this site, the link "Ask Question" points to a URI. It is just as easy to make the link text look like a URI but have it point somewhere else. – schroeder Jul 7 '15 at 16:48
  • @hd. no, I use Skype 7.7 on Mac the HTML tags should not be available here – Yahor Jul 8 '15 at 10:56
  • @schroeder sure, but Skype does not allow to set custom link text – Yahor Jul 8 '15 at 10:59
10

Currently there is a small breach in the Skype for Web. Any HTML code is escaped on the client side before it is posted to the Skype server. But you can send unescaped HTML by writing some JavaScript code.

The steps follows:

  1. Go to Skype for Web via Chrome
  2. Open JavaScript console and execute:

    // replace standard XHR.send() with our custom implementation
    XMLHttpRequest.prototype.oldSend = XMLHttpRequest.prototype.send;
    var newSend = function(args) {
        try {
            // messages to the server are posted via JSON
            // in 'content' field
            var m = JSON.parse(args);
            if (m.content && m.content.indexOf('secret') === 0) { // 'secret' is our codeword
                // if the message begins with 'secret', replace it by our HTML with the link
                m.content = '<a tabindex="-1" target="_blank" href="http://security.stackexchange.com/questions/93305/insert-hidden-link-in-skype">http://watch-yourself.com</a>';
                this.oldSend(JSON.stringify(m));
            } else {
                // if no 'content' field or no 'secret' codeword, then send as is
                this.oldSend(args);
            }
        } catch (x) {
            // if not JSON, then send as is
            this.oldSend(args);
        }
    }
    XMLHttpRequest.prototype.send = newSend;
    
  3. Type 'secret' in any chat message

  4. The resulting message shown in the desktop version of Skype:

hidden link by Skype for Web

Not the answer you're looking for? Browse other questions tagged or ask your own question.