Facebook's URL Scanner Vulnerable To Cloaking Attack 34
Facebook's recent move to scan for malicious URLs sounded like a pretty good idea, but itwbennett writes with word that it's already been bypassed.'Hatter,' a member of hacking think-tank Blackhat Academy, provided a live demonstration, which involved posting the URL to a JPEG file on a wall. Facebook crawled the URL and added a thumbnail image to the wall post, however, clicking on its corresponding link actually redirected users to YouTube. This happened because the destination page was able to identify Facebook's original request and served a JPEG file. Earlier this week, Facebook signed a partnership with Websense to use the security vendor's cloud-based, real-time Web scanner for malicious URL detection. Blackhat Academy has now provided proof-of-concept code, which, according to its advisory, can be used to bypass it."
Re:First Post (Score:4, Funny)
Raising money for security research company (Score:2, Funny)
Guys, I've discovered that if you do
if ($certainUserAgent) {
print 'Something;
} else {
print 'Something else';
}
I'm going to start a security company, is anybody interested in hiring researchers for their operations. Corporate contracts start at $100,000.