8 ms·
Faking Twitter unfurling to phish you
- Thorrez 5y agoWhy does this require the extra step of using a burner account? Why not tweet https://twitter-unfurl-faker.herokuapp.com/ https://twitter-unfurl-faker.herokuapp.com/ from your main account and that's it? Does Twitter only unfurl t.co URLs? If so, why would they write separate code for unfurling t.co with ?amp=1 vs without ?amp=1 ? And why would Twitter unfurl a t.co link past the first non-t.co URL? I guess that's the vuln, right, that they don't stop after the first non-t.co URL?
- manmal 5y agoSometimes, t.co links redirect 5+ times until the target domain is reached, so I guess fixing this would break a lot of twitter‘s content.
- Thorrez 5y agoYou mean they redirect through various different domains not affiliated with Twitter before reaching the end? Who creates these links? Is it people creating short links before posting to twitter? What's the purpose? Just tracking?
- gitgud 5y agoNot really a logical phishing strategy, if the first domain looks safe and the attacker controls it, why wouldn't they just use that to serve a phishing page? Instead of needlessly redirecting... A better example would be to show "google.com" and somehow redirect to "phishing.com"... but that's not really possible without control of "google.com"
- yyyk 5y ago>but that's not really possible without control of "google.com" An open redirect bug in phished site should allow this scenario: A) Set up the offending link, redirecting to the phishing.com site. B) When receiving the twitter bot, redirect back to a safe page on the original site for the summary. I understand twitter shows either the original URL or the final URL, but doesn't care for phishing.com in the middle. C) Don't redirect back for non twitter traffic, so they end up on phishing.com. A complex scenario, but perhaps enough to show that redirect bugs also matter.
- genewitch 5y agoRecent memory tells me Google has an issue and had another issue. You can have a Google.com page like google.com/awesomesite/ And earlier there was a Google redirector that was forgotten about and was being used to redirect to phishing sites.
- voussoir 5y agoI don't agree with your analysis. There are three domains at play: twitter-unfurl-faker.herokuapp.com, uniswap.org, and harrydenly.com. The first is the real link, the second is what Twitter's link previewer gets redirected to, and the third is where the user gets redirected to. It seems to me that the author does not need control over the second domain, just the first and third. But the user will never see the first URL, only the second.
- gitgud 5y agoAs I understand it, the webserver at twitter-unfurl-faker.herokuapp.com just dynamically redirects based on the user-agent. The attacker doesn't need control over uniswap.org or harrydenly.com to make this work. They only need control of harrydenly if they want to serve a phishing page. But as I said above this is redundant and they could just use this domain to also serve the redirection. Example below: * (Twitter bot) phishing.com -> redirects -> fishtanks.com Twitter bot makes shortened link t.co/aaa (but the preview shows fishtanks.com) * (User) t.co/aaa -> phishing.com
- fareesh 5y agoThey can add "redirected from xyz" to the card perhaps.
- bartkappenburg 5y agoWhy not do it the other way around? Serve a page without a redirect to the twitter-bot and detect if the header does NOT contain twitter to serve a redirect?
- stavros 5y agoBecause my domain evil.com cannot serve a page from uniswap.org (because it's a different domain).
- ch0I9daAiO 5y agoYou can do the same with VirusTotal. Check the UA, if it's Virus Total, serve a legit page, if it's non VT, serve the malicious one. Simple 301 redirects will be detected and presented to the analyst, URL rewrites wont.
- pyrolistical 5y agoThis doesn’t make sense. Why doesn’t the Twitter bot serve the final site location after following all the redirects. Then since the bot sees the correct site it redirects to the correct site
- seoulmetro 5y agoBecause you can make a bot do what you want and a non-bot do something else.
- sigsergv 5y agoAnd also don't trust this link: https://t.co/MPesRJdK5y https://t.co/MPesRJdK5y
- reginold 5y agoIs there any sort of within-a-page HTTPS "secured" function? Like how banks have that "only type your password if we show your correct profile picture". Almost like if embedded tweets could be "signed" by twitter in a way that would register in my browser in a graphical way that would not be known to the server itself (ie putting the twitter logo next to a tweet is easily faked). But if content appearing to be from twitter was verified instead, and had my custom chosen avatar next to each showing both my key and twitter's key had signed the text. Maybe not making sense, if anyone wants to play this back clearer go for it :)
- thaumasiotes 5y ago> Like how banks have that "only type your password if we show your correct profile picture". Do they? My banks did that years ago, and they also stopped doing it years ago.
- captn3m0 5y agoThey are ineffective. >Of the 63 participants whose responses to prior tasks had been verified, we were able to corroborate 60 participants’ responses to the removal of their site-authentication images. 58 of the 60 participants (97%) entered their passwords, de-spite the removal of the site-authentication image See https://security.stackexchange.com/a/19801 https://security.stackexchange.com/a/19801 which summarises https://sites.google.com/site/ianfischercv/emperor.pdf https://sites.google.com/site/ianfischercv/emperor.pdf
- dgoldstein0 5y agoSome still do. I don't see the point though - a determined attacker could just make http requests to your bank and substitute the parts they want to. Would be on the attack domain still so still technically phishing... But if the image is an anti phish measure it's not a great one. I suppose it could raise the bar to a successful attack a bit but certainly doesn't make it impossible.
- phsau 5y ago
- sodality2 5y agoWhy would twitter trust the Location header and not just parse the URL given to them? This seems like a strange choice to rely on their backend lookup just to display the URL...
- selcuka 5y agoBecause that's how HTTP redirects work. A `t.co` link is simply a 301/302 redirect to another site with a `Location` header.
- AlphaWeaver 5y agoTwitter follows the Location header since the purpose of that header is to redirect to another page. It's considered a good user experience to display the final page as a link preview rather than the intermediary redirect.
- Retr0id 5y agoFirefox is doing a horrendous job of rendering the text on this site for me, on Arch Linux. Is it just me? https://i.imgur.com/ZP9wC85.png https://i.imgur.com/ZP9wC85.png
- Cerium 5y agoLooks like some poor subpixel rendering. You might want to try looking for some settings to tune it.
- rvz 5y agoGiven that you're using a version of Arch Linux, Firefox and focusing on one particular site, It's probably only just you.
- nightfeather 5y agohappens to have a same setup as you, I don't have such problem.
- recursive 5y agoOk, but what's unfurling? As far as I can tell, this is just tricking the thing that tells you the target domain of a shortened link? But if you clicked the link, you could just see the link though right. How is this fooling anyone?
- Thorrez 5y ago> Ok, but what's unfurling? I've never heard the term before now, but I interpreted it to mean following redirects to get the end page. > But if you clicked the link, you could just see the link though right. How is this fooling anyone? It fools you before you click the link. After you do, you're no longer fooled, as long as you pay attention to the URL bar. The obvious problem is people who don't pay attention the the URL bar. Another problem might be you're forbidden from viewing certain sites at work, you see a link that goes to news.ycombinator.com knowing that's safe, but then go to a forbidden site instead. Another problem would be browser 0-days. A link to news.ycombinator.com would be safe assuming it hasn't been compromised itself, but a different website might spring a browser 0-day on you.
- ec109685 5y agoUnfurling is showing the preview of the link within the tweet.
- wereHamster 5y agoUnfurling is the process of fetching additional information (title, description, image) and showing that on the platform itself. Twitter does it, Facebook, Slack too. On Slack you can implement custom unfurling that does more than just show the title/description/image. See docs here: https://api.slack.com/reference/messaging/link-unfurling https://api.slack.com/reference/messaging/link-unfurling. I'm currently building one such custom integration
- seoulmetro 5y agoThis is pretty dumb. It's like writing `[google.com](notgoogle.com)` and making out like its a significant security flaw or new idea.
- animal_spirits 5y agoThis is actually quite more complicated. Your webbrowser (firefox does, at least) will show you the destination link if you hover over any link element. In the case on the article, the destination link is exactly how it is written. So how can we now trust that twitter's shortening links only go to twitter?
- seoulmetro 5y agoIsn't the destination link `t.co/XYZ` ? That's what it has been for me in Facebook, Twitter, Instagram, etc. their own mangled URL. And no, I don't trust those either. >So how can we now trust that twitter's shortening links only go to twitter? They never did. Edit: Just checked his example, and yes. It looks like the hover link is still a random garbled `t.co/XYZ` and not `uniswap.org`. I'm still right and it's still pretty dumb.
- deleted 5y ago[deleted]
- zinekeller 5y agoJudging from the comments, some are really confused on what's happening here. The real trick is that TwitterBot and you see different pages. For TwitterBot, which always clearly identifies itself (and some other signs like whether it is from Twitter's network infrastructure), the flow is t.co -> attacker.site -> legitimate.site, and so shows in the card (technically called unfurling) the details of the legitimate site, including the coveted legitimate domain name. For you, the attacker.site detects that you're not TwitterBot and do whatever phishing attempt they need to do. Of course, if you do check the domain name on your browser, it won't work... but let's be honest, that's just a fraction of people here, not even including the general public. Others ask why TwitterBot does redirections, and it seems that everyone here forgot that marketers love their Bit.ly and Sprinklr links so much that Twitter needs to have a concession here (and no, you can't just whitelist them because some companies uses their own different shortlinks like t.co, fb.me, g.co, msft.it, redd.it, and youtu.be). Why not just directly serve the redirection as seen by TwitterBot? Because a) marketers and analytics and b) because services like Branch (app.link) and Adjust does redirect users differently depending on their specific device (like Windows vs macOS vs Linux (or even a specific distro!) vs iOS vs Android).
- Ansil849 5y ago> Others ask why Twitter does redirections, and it seems that everyone here forgot that marketers love their Bit.ly and Sprinklr links so much that Twitter needs to have a concession here. As far as I know, users cannot view the metrics for t.co links, or am I mistaken about that?
- TheDong 5y agoYou misunderstand. "Why twitter does redirections" is "why does twitter follow Location headers to get unfurl info / metadata", not "why does twitter have t.co", and the reason is because marketers use bit.ly etc, so twitter has to follow those redirects. Marketers/users cannot view t.co metrics, but even if they could, they'd want to use their own url shorters anyway I'm sure... so twitter has to have the t.co previewer follow arbitrarily many redirects.
- eyelidlessness 5y agoTrick’s on me, someone finally got me to look up what the heck some cryptocurrency thing is because this article made no sense otherwise.
- eyelidlessness 5y agoAlso this is much less sophisticated than fooling curl | sh, but people continue to insist that’s perfectly fine.
- dpwm 5y agoI don’t think I’ve seen anybody insist curl | sh is fine from untrusted sources. In many contexts, curl | sh is an alternative to adding some kind of additional repository to install a third party package — and in most package managers this is done as root anyway, with arbitrary pre-install and post-install scripts. I’m not really sold on how curl | sh (with https) is any less secure than blindly following steps to add a repo. I used to strongly dislike curl | sh, and if there’s some looming security risk beyond accidentally trusting bad actors who couldn’t be bothered to go to all the effort of setting up a repo then I’d genuinely like to know.
- eyelidlessness 5y agoYou can detect curl | sh server-side and respond with different content than the inspectable source. The link I typically cite isn’t loading for me but you should be able to find more info if you’re curious.
- Sophira 5y agoI have seen plenty of curl | sh invocations that pass the "-k" flag to curl, meaning that curl will allow insecure connections even if there are invalid SSL/TLS certificates.
- calmingsolitude 5y agoThis reminds me of a little joke link shortener I built[0] that allows you to set the various opengraph tags to the shortened url. This lets you completely fake the link preview generated by most platforms that show you one. Even though I originally built it as a joke, I find myself using it pretty often to make links 'self-explanatory'. [0] https://github.com/radiantly/the-redirector https://github.com/radiantly/the-redirector
- zinekeller 5y agoNot the blog author, but practically speaking, faking OpenGraph tags would result in same phishing capability (considering that most people don't check the cards carefully), but it'll still show that the link was not from that site. But again, most people would still click paypal-not-really.com or coinbase-is-not-controlling-this-site.com