Why did you just click that link? Most likely you have came to this site by clicking a link from another site. Why did you do that? Did you trust the person who sent you the link? Did you click a link from twitter, facebook, or an email someone sent you?
When you click a link, you are telling your browser, "I trust this person." However, this is not the way we use the internet. We click on links all the time. We click on links from "untrusted" sources. We click links from people we don't know and we even click on URL's that have been modified. On Twitter, a person is much more inclined to click the shortened link
http://bit.ly/5hXRW then they are to click
http://somewherebank.com/transfer.jsp?amount=1000&to_account=56777564. Even though the shortened link could redirect to the somwherebank.com site.
But, why would someone trick you into clicking a cleverly disguised link? The site that you are redirected to may seem harmless. It could also be extremely malicious.
What happens if this page, (the one you are currently viewing), was filled with Cross-Site Request Forgery (CSRF) links? This web page could be setup with all types of malicious intent. However, you didn't know that when clicking the link. Now, it is too late.
If this site did have Cross-Site Requests, I could do things such as:
- Change the password on your facebook account
- Transfer the money from your online bank account to another account
- Enact trades from a financial institution such as E*Trade
The sites that I exploit would have to be vulnerable to CSRF. But researchers, such as
Mike Bailey and Russ McRee, are constantly finding CSRF vulnerabilities in web applications.
An example of how clicking links from untrusted sources is never good was demonstrated in Billy Rios and Nitesh Dhanjani,
Bad Sushi talk. In their presentation they described sending phishers a word document stating their account numbers were inside. They sent this email to 25 known phishers. 10 of the phishers opened the word document and were presented with
this. In additon, there was another link that said, "Actually, my account information is
here." 3 of the 10 clicked on that link. Even the phishers click links they shouldn't.
What should be done? Who knows. It is human nature to trust people and we can't get things done if everytime someone sends us a link we open up a VMware image to view a link. So continue using the Internet the way you have been and remember, "These aren't the droids your looking for."
