32

Today I have received a phishing email impersonating Netflix. When inspecting the email I have noticed the email used Stack Overflow Jobs URL redirects to hide the real URL of the phishing site.

You can find the full link below:

https://stackoverflow.com/jobs/companies/a/ext-link?redirectUrl=https%3A%2F%2Flearnfacta.com%2Fprivacy_policy&companyPageId=15983&externalLink=Email&data=02|01||c85849a7fc354c468eba08d84df891f3|84df9e7fe9f640afb435aaaaaaaaaaaa|1|0|637345077272641775&sdata=BOnUrqzDnHgXAVnwODyV4vOxYzp2DEa/XmiKepS8SWo=

and the redirect URL portion leads to: https://learnfacta.com/privacy_policy

which redirects a final time to https://netflix.problem-accountrestore.net/login, which looks like a legit Netflix login page:

Netflix fake login page

I am not sure if this report is any use to the Stack Overflow staff, but better to be safe than sorry.

3
  • 1
    It may be just a URL rewriter on SO. Testing and verifying links it uses might be a bit difficult. If they wanted to, perhaps they could use a link whitelist that gets added to when a job text submission includes a link, and reject links outside the whitelist. Sep 1, 2020 at 6:00
  • 8
    Thanks for the heads up, we're addressing the underlying issue now
    – Dean Ward
    Sep 1, 2020 at 12:23
  • Don't know if this is important but a similar email redirects to doceo.com.mx
    – medic17
    Sep 1, 2020 at 23:14

1 Answer 1

21

First, thanks for this report. Due to the security awareness of our users, we heard about it from the community from many angles (on meta, support emails, and Twitter DMs) very quickly. Sincerely, thanks for that!

The open redirect in question was tracking outbound clicks from our company pages for analytics. The one used in the campaign in an attempt to steal Netflix credentials was 1 of ultimately 3 that we saw had the potential for exploitation in a similar manner. Rather than protect these routes with an HMAC or other means to ensure they were not open redirects, we moved to a best-effort client-side version (used elsewhere in our infrastructure) and removed these routes completely.

This change went out Tuesday afternoon and closes the door on this sort of exploitation from happening. We already deploy static code analysis to ensure this does not happen in the core Q&A product today and are also already in the process of moving the jobs product to .NET Core to employ the same automated protections there.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .