Deceptive Previews: A Study of the Link Preview Trustworthiness in Social Platforms

Abstract

Social media has become a primary mean of content and information sharing, thanks to its speed and simplicity. In this scenario, link previews play the important role of giving a meaningful first glance to users, summarizing the content of the shared webpage within their title, description and image. In our work, we analyzed the preview-rendering process, observing how it is possible to misuse it to obtain benign-looking previews for malicious links. Concrete use-case of this research field is phishing and spam spread, considering targeted attacks in addition to large-scale campaigns. We designed a set of experiments for 20 social media platforms including social networks and instant messenger applications and found out how most of the platforms follow their own preview design and format, sometimes providing partial information. Four of these platforms allow preview crafting so as to hide the malicious target even to a tech-savvy user, and we found that it is possible to create misleading previews for the remaining 16 platforms when an attacker can register their own domain. We also observe how 18 social media platforms do not employ active nor passive countermeasures against the spread of known malicious links or software, and that existing cross-checks on malicious URLs can be bypassed through client-and serverside redirections. To conclude, we suggest seven recommendations covering the spectrum of our findings, to improve the overall preview-rendering mechanism and increase users' overall trust in social media platforms.

Understanding Phishing in Mobile Instant Messaging: A Study into User Behaviour Toward Shared Links

“…Our work falls within the scope of the latter, so this section will provide an overview of research in this area, focusing on the mobile context. However, it is interesting to note that MIM apps do not provide any automated means for detecting and blocking links [5].…”

“…This is not surprising considering the popularity of these apps, with recent data showing that 3.09B mobile phone users communicated using these apps in 2021 [4]. The lack of countermeasures to protect MIM app users from phishing [5] and functions like sharing and forwarding links, creating and joining private and public groups advertised online actually facilitate phishing. The small screen size of mobile devices and the fact that users are likely to check messages while engaged in other activities may also affect users' ability to assess message validity and spot phishing thus increasing their susceptibility.…”

To Err.Is Human: Characterizing the Threat of Unintended URLs in Social Media

“…Orthogonally to spam and account hijacking, researchers have also investigated the security side-effects of allowing users to change their usernames on popular social network platforms [34] as well as whether attackers can confuse users about the nature of posted URLs via web cloaking [40].…”