Can YouTube YouTube URLs be fake links?

For content on legitimate websites such as Instagram or Youtube, users will be interested and curious, so often click on the link attached to view the content. However, URLs now have a lot of fake cases and can cause you a lot of trouble.

When browsing through the New Feed on Facebook , there will be a lot of news and new links displayed with eye-catching information such as title, description, image and URL, which makes users curious and want to click to view content.

Be careful when clicking on Youtube URLs on Facebook

Facebook is filled with content such as ads, spam content, news, notifications ... users will not care much about these links, but when you see the url of Youtube or Instagram users will be more interested because Those are reputable sites, but some guys have taken advantage of YouTube's reputation to forge links.

Although the links before sharing on Facebook cannot be edited, but to prevent false or misleading information. Facebook removed the ability to edit the title, thumb image and description of the links shared on the page in July.

However, spammers can fake the URL of shared links to trick users into clicking on links and redirecting to websites that are not as displayed, or redirecting users to partly Soft and malicious content. Worse, the link can lock your Facebook or send your friends information about that link, make you uncomfortable when using Facebook or create a new Facebook account and you'll have to make friends. and reset the information from the beginning.

Barak Tawily , a security researcher, discovered a simple trick that any user could forge links on URLs by exploiting a preview of Facebook links.

Facebook will scan parts of the sharing link, including the Open Graph meta tag to identify attributes like "og: url" , "og: title" to get the URL, thumb image and title of the site.

Tawily said the interesting point is that Facebook will not confirm if the link in the "og: url" meta tag is the same as the page URL, enabling spammers to spread malicious websites on Facebook with fake URLs. by adding valid URLs to the "og: url" in the Open Graph meta tag on their web pages.

Answering on The Hacker News , Tawily said: "People on Facebook often think that the preview data displayed on Facebook is reliable data, and they will click on the links that interest them. this invisibly provides an opportunity for the attacker. Hackers can abuse this feature to perform various attacks, including fraudulent / advertising / click-based campaigns. " .

Although Tawily reported the issue to Facebook, the social networking site refused to consider it a security flaw, saying it would use " Linkshim ". A system that checks the URL when a user clicks on any link on Facebook to see if it is a malicious link or not to handle and combat such attacks. However, if fake links are created from a new domain , Linkshim will find it difficult to determine if the link is malicious.

And although Linkshim used Machine Learning to identify the content of malicious websites. Tawily discovered that Linkshim's protection mechanism could be bypassed by directly providing non-toxic content to Facebook bots based on User-Agent or IP address.

Since there is no way to check the actual URL after the link has been shared on Facebook, the only way is to open the link, users must consider the warning and caution before clicking to open the link to protect the account themselves. mine. One more thing is that even your phone will be sticky, so you have to be careful when clicking on strange links because if the phone is infected with malicious code, it will be very dangerous.