Technology

59589 readers

2891 users here now

This is a most excellent place for technology news and articles.

Our Rules

Follow the lemmy.world rules.
Only tech related content.
Be excellent to each another!
Mod approved content bots can post up to 10 articles per day.
Threads asking for personal tech support may be deleted.
Politics threads may be removed.
No memes allowed as posts, OK to post as comments.
Only approved bots from the list below, to ask if your bot can be added please contact us.
Check for duplicates before posting, duplicates may be removed

Approved Bots

founded 1 year ago

MODERATORS

546

It's Not Safe to Click Links on X (lifehacker.com)

submitted 8 months ago by Stopthatgirl7@lemmy.world to c/technology@lemmy.world

77 comments fedilink hide all child comments

As noted by security researcher Will Dormann, some posts on X purport to lead to a legitimate website, but actually redirect somewhere else. In Dormann's example, an advertisement posted by a verified X user claims to lead to forbes.com. When Dormann clicks the link, however, it takes him to a different link to open a Telegram channel that is, "helping individuals earn maximum profit in the crypto market," he said. In short, the "Forbes" link leads to crypto spam

you are viewing a single comment's thread
view the rest of the comments

[–] gian@lemmy.grys.it 10 points 8 months ago (1 children)

Damn, a security researcher discovered what was known from late 1990's/early 2000's: a link on a webpage could take you in a place that it is not the one the link say it will be.

[–] wagoner@infosec.pub 9 points 8 months ago

I get the knee-jerk jaded cynicism but this is a little more nuanced than that.

"All they have to do is set up two different URL destinations in their post. In the case outlined above, clicking the forbes.com link actually takes you to joinchannelnow.net. Once on this site, the server checks to see whether the request is coming from a typical browser (that's you). If so, it'll take you to the spam site, which for this situation is a crypto scam Telegram channel. However, if the server detects the request is coming from something else—like a X link-verifying bot—it'll assume the request is not being made by a human; in these cases it returns a legitimate URL. So, even though the first link is to joinchannelnow, X checks it and is taken to forbes.com, and so it places that URL preview on the post. You're experience will be different."