Link Previews in Chat Apps Pose Privacy, Security Issues: Researchers

guest · Oct 28, 2020

Researchers: LinkedIn, Instagram Vulnerable to Preview-Link RCE Security Woes
October 27, 2020
https://threatpost.com/linkedin-instagram-preview-link-rce-security/160600/

Link previews in popular chat apps on iOS and Android are a firehose of security and privacy issues, researchers have found. At risk are Facebook Messenger, LINE, Slack, Twitter Direct Messages, Zoom and many others. In the case of Instagram and LinkedIn, it’s even possible to execute remote code on the companies’ servers through the feature, according to an analysis.

Link previews are standard in most chat apps, and they can be very useful. When a user sends a link through, it renders a short summary and a preview image in-line in the chat, so other users don’t have to click the link to see what it points to.
Unfortunately, there’s a downside.
Click to expand...

Remote Code-Execution Woes
As far as the code-execution issue, the researchers posted a video with a proof-of-concept of how hackers can run any JavaScript code on Instagram servers. And in LinkedIn Messages case, the servers were also vulnerable to running JavaScript code, which allowed them to bypass the 50 MB download limit in a test.

“You can’t trust code that may be found in all the random links that get shared in chats,” Bakry and Mysk explained. “We did find, however, at least two major apps that did this: Instagram and LinkedIn. [...] We were able to confirm that we had at least 20 seconds of execution time on these servers. It may not sound like much, and our code didn’t really do anything bad, but hackers can be creative.”
Neither company responded to the researchers’ concerns. But the Facebook spokesperson told Threatpost that the feature works as intended, and that it’s not a security vulnerability.

As for LinkedIn, a spokesperson told Threatpost via email: “To help keep our members safe, we use a sandbox environment to evaluate the security risk of the links being shared. These environments are ephemeral and have strict access controls that are designed to discover malicious code execution
Click to expand...

But Mysk noted that such protections may not be good enough.

“Server-side mitigations such as running JavaScript code in a sandbox environment is effective in thwarting most attacks, but more sophisticated attacks could allow the attacker to leave the sandbox and execute code outside the protected environment, which could potentially allow the attacker to steal data and secret keys,” he told Threatpost.
Click to expand...

guest · Oct 28, 2020

Link Previews in Chat Apps Pose Privacy, Security Issues: Researchers
October 27, 2020
https://www.securityweek.com/link-previews-chat-apps-pose-privacy-security-issues-researchers

Link previews provide users with information on what a link received in chat would lead them to, regardless of whether it is a file or a web page.
However, link previews can be abused for nefarious purposes, and security researchers Talal Haj Bakry and Tommy Mysk claim to have identified several cases in which popular chat apps for iOS and Android fail to provide their users with the necessary protections against such abuses.

Due to the manner in which link previews are implemented, some applications were found to leak users’ IP addresses, others to leak links that have been sent in conversations encrypted end-to-end, while some would unnecessarily download large amounts of data, even gigabytes, in the background.
The analyzed applications include Discord, Facebook Messenger, Google Hangouts, iMessage, Instagram, LINE, LinkedIn, Reddit, Signal, Slack, Threema, TikTok, Twitter, Viber, WeChat, WhatsApp, and Zoom.
Click to expand...

Link Previews: How a Simple Feature Can Have Privacy and Security Risks

We think link previews are a good case study of how a simple feature can have privacy and security risks. We’ll go over some of the bugs we found while investigating how this feature is implemented in the most popular chat apps on iOS and Android.
Click to expand...

Approach 1: The sender generates the preview ✅
In this approach, when you send a link, the app will go and download what’s in the link.
This way, the reciever would be protected from risk if the link is malicious.
Approach 2: The receiver generates the preview
This one is bad. This approach means that whenever you receive a link from someone, your app will open the link automatically to create the preview. This will happen before you even tap on the link, you only need to see the message.
Approach 3: A server generates the preview
This takes the “middle” approach, quite literally. When you send a link, the app will first send the link to an external server and ask it to generate a preview, then the server will send the preview back to both the sender and receiver.

At first glance this seems sensible.
Click to expand...

Where to go from here?
We think there’s one big takeaway here for developers: Whenever you’re building a new feature, always keep in mind what sort of privacy and security implications it may have, especially if this feature is going to be used by thousands or even millions of people around the world. Link previews are nice a feature that users generally benefit from, but here we’ve showcased the wide range of problems this feature can have when privacy and security concerns aren’t carefully considered.

If you’re not a developer, we hope this report gives you an appreciation for the subtleties of the small differences in the same exact feature, and how these differences can have a massive impact on security and privacy.
Click to expand...

Rasheed187 · Oct 31, 2020

Yes this all isn't a surprise, I have never been a fan of this "link preview" stuff.

Log in or Sign up

Link Previews in Chat Apps Pose Privacy, Security Issues: Researchers

guest Guest

guest Guest

Rasheed187 Registered Member

Log in or Sign up

Link Previews in Chat Apps Pose Privacy, Security Issues: Researchers

guest Guest

guest Guest

Rasheed187 Registered Member

Useful Searches