21

I've noticed for a very long time that when you try to copy a link location or open a link on Facebook, it modifies the link and passes it through l.php.

For example, I can be sent to

 http://www.facebook.com/l.php?u=http%3A%2F%2Fwww.google.com%2F&h=DKVUritNDJDJLDLVbldoDLFKBLOD5dlfDJY_-d3fgDUaA9b

even though my browser render the link preview as http://www.google.com/.

Today, I took a closer look using Firebug and found that Facebook puts onmousedown="UntrustedLink.bootstrap($(this)[...] in the <a> tag. The second I right clicked the link, I saw the href attribute change in Firebug.

This worries me.

The advice many of us have given to less tech-savvy people (check where the link is taking you before you click so that you don't become a victim of phishing) now seems to have become useless. Isn't this a security risk? Can't phishing websites misuse this?

Why don't browsers prevent this behavior either by disallowing onmousedown to change the href or by running the javascript before reading the href attribute, so that I am sent to the location I thought I going to, not the one change while I was clicking it?

Edit: I want to briefly emphasize that what bothers me more than the risk of phishing is that users are being misled and it simply feels wrong to me that this can happen, whether by a trusted source or not.

2
  • 1
    Having a limitation like this one will not solve anything. Aug 26, 2011 at 14:17
  • 1
    Onmousedown link changing is an incredibly annoying behavior as it makes it complicated to quickly paste links. That said, outgoing click tracking is important, so maybe the better solution would be if browsers supported a more transparent method of hijacking clicks.
    – Tgr
    Aug 26, 2011 at 15:13

3 Answers 3

5

I agree that there is potential here for phishing. This was reported as a bug in FireFox quite a long time ago, but the problem is this:

<body onmousedown="document.getElementById('changeMe').href='www.somewhereelse.com'">
    <a id="changeMe" href="www.google.com">google</a>
</body>

Events bubble up to their parent, you would need to detect if an onmousedown event was going to change the href of a child element. Sounds reasonable? Okay, how about this:

<script>
    function switcher() {
       window.location = "www.somewhereelse.com";
       return false;
    }
</script>
<body onmousedown="switcher()">
    <a href="www.google.com">google</a>
</body>

So we need to look out for window.location in functions triggered by onmousedown events as well. Still sound reasonable? How about if I have the onmousedown event remove the link altogether, replace it with a new element and then trigger the click on that. I can keep coming up with examples.

The point is, Javascript can be used to misdirect people using the status bar - you shouldn't trust it, you can only trust the URL.

To change this browsers would need to give the set href value on a link at the time of the click presidency over any other events that might happen, basically disable mouse events on anchor tags. I would venture to guess they probably won't do this, it would break too many applications that already exist.

Edit: Alternatively, I've seen people propose different methods of detecting and warning the user about possible link hijacking, but I've not seen any implemented yet.

5
  • Just to understand this a little better and to get your view on this: Is it possible, then, for a browser to delay mouse actions, until after the navigation has happened? That will mean that if the link is within the page (e.g. href="#foo") the JS will still work (browsers could indicate this in the url preview), but if the link actually points to a different page, you are sent to the page that you actually think you are going to. If, as Tgr suggested, browsers transparently told the website where you are going, browsers could let you know that the site is being told using a small icon.
    – Umang
    Aug 26, 2011 at 18:11
  • 1
    To rephrase your approach: First let the navigation happen based on the href value of the link when you clicked it, then execute Javascript event and let the user know with an icon that a Javascript event is going to be delayed by the navigation. The problem I see is: what if the event was meant to stop the navigation?
    – nwellcome
    Aug 26, 2011 at 18:21
  • I have more thoughts I can't fit in the comments, should we move to a chat?
    – nwellcome
    Aug 26, 2011 at 18:27
  • Sure. I haven't used it before. Do you make a new chat room or use an existing on like JS?
    – Umang
    Aug 27, 2011 at 1:44
  • While I haven't been able to get onto chat, it seems like there is no simple answer to my question. If you could post links/brief summaries to those different methods, that would be terrific. I was hoping for an answer that both (a) explained why there is no simple solution and (b) shared a thought for the future: are links always going to be like this or is there anything that we can look forward to? I think your answer was almost there. I am accepting it anyway, although, like I said before, a link or an explanation of those ideas you mentioned would be great.
    – Umang
    Aug 29, 2011 at 4:08
3

The advice many of us have given to less tech-savvy people (check where the link is taking you before you click so that you don't become a victim of phishing) now seems to have become useless.

If by "check" you mean the link 'preview' browsers show at the bottom status bar then you are correct. That is not enough to check whether a link really goes where it claims to be going. For instance, running the jquery script below on a page will cause all link to go to google.com regardless of what the actual href target of the link is:

$('a').click(function(evt){evt.preventDefault();window.location.href="http://google.com"})
2

Can't phishing websites misuse this?

Not really, because facebook is where the said javascript would have to be called from. The user has to go an untrusted source in the first place who would embed the javascript in the tag.

2
  • 4
    Even trusted sites can fall victim to vulnerabilities that would allow an attacker to inject code like this.
    – pulsar
    Aug 26, 2011 at 14:45
  • 3
    If a 'trusted site' were to be vulnerable to XSS, I'm sure the aforementioned vulnerability would be the last thing an attacker would want to exploit.
    – Richard EB
    Aug 26, 2011 at 15:37

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.