0

I received one of those messages from a Facebook friend where it says something like "Is this really you in this video?" and then send an accompanying link. I clicked this link from within Messenger on my Android phone and it opened a pornography website in my browser. I immediately closed the site but am now worried what information of mine might be compromised.

I have been googling this and many people say that it is a common phishing scam where they can get my Facebook login details and then send the message on to more people. However, I wasn't taken to a fake Facebook website and was never given an opportunity to provide my login details. I think it was just wanting me to sign up to a pornography website.

  • If they didn't get me to login, how would they get my login details? Could I still be compromised?
  • And if their intention wasn't to get my details, how did the person that sent it to me get compromised?
  • Would it be dangerous if I were logged into the mobile Facebook website in a browser (not the app)?
  • Is it possible that something was downloaded to my Android just bey clicking the link? Is there a way I can check (or scan) effectively?
Anders
  • 64,406
  • 24
  • 178
  • 215
Sam
  • 103
  • 1
  • 3

2 Answers2

1

If they didn't get me to login, how would they get my login details? Could I still be compromised?

Most likely they did not get your credentials. You can change your password just to be on the safe side if you want to, but I would not worry to much about it.

And if their intention wasn't to get my details, how did the person that sent it to me get compromised?

There are many possible ways. Perhaps he entered his password into a phishing site (either the one you were taken to, or some other site). Maybe he reused the same password on other sites, and one of them got hacked.

(A way things like this spread back in the day was through clickjacking attacks, where the malicious page would load e.g. Facebook in a transparent iframe, and fool you into clicking the invisible facebook buttons. But I am pretty sure Facebook protects against that nowadays.)

Would it be dangerous if I were logged into the mobile Facebook website in a browser (not the app)?

I don't think it makes a lot of difference. If there was some kind of exploit, it happend in the browser after you clicked the link. And it's the same browser no matter what app you come from.

Is it possible that something was downloaded to my Android just bey clicking the link? Is there a way I can check (or scan) effectively?

Yes, it is possible to get infected by malware by just visiting a site. But if your browser is up to date and you have Flash and Java disabled by default I would not worry to much about it.

There are plenty of antivirus programs that include support for mobile devices. You could install one and scan your phone. No scan is 100% though.

(I don't know enough to make a specific recommendation, and software recommendations are not on topic here anyway.)

Community
  • 1
Anders
  • 64,406
  • 24
  • 178
  • 215
1

I'm inclined to say that because you were using Android, you are likely to be quite safe.

With most Android browsers, you will see a notification about a downloaded file. This is because the browsers on Android (including Firefox) use the OS functionalities built in. There doesn't seem to be any way around this, and a website can not call for the file to be executed upon a completed download.

If you had opened the link on a desktop operating system, the story would likely be different. Due to the lack of a heavily sandboxed OS and it's applications, a browser vulnerability could have spelled trouble. This is what is commonly assumed in social networking attacks.

Due to the lack of "information security knowledge" some users will:

  • Give their details away by phishing
  • Share a link on Facebook by clickjacking (circa ~2009)
  • Leave a session open on a public computer
  • Copy and Paste a link for a XSS (Cross Site Scripting) attack
  • Use a weak, easy to guess password

These all provide ways to spread malware on Social Media websites such as Facebook. The strongest recommendations I can give are for you to:

  • Clear out your phone's downloaded folder
  • Ensure you are logged out of all sessions on Facebook (It gives some functionality for this)
  • Start a discussion around information security with your friend
  • Ensure you don't copy/paste strange or odd looking URLs into your browser
  • If you still feel "insecure", change your password and enable 2 factor authentication

Web Links:

http://www.pcworld.com/article/2036252/how-to-set-up-two-factor-authentication-for-facebook-google-microsoft-and-more.html

https://www.facebook.com/note.php?note_id=10150172618258920

https://www.facebook.com/help/1412219392366297

https://www.facebook.com/help/246962205475854?helpref=related&ref=related

dark_st3alth
  • 3,052
  • 8
  • 23