{"id":9290,"date":"2019-09-18T17:07:24","date_gmt":"2019-09-18T21:07:24","guid":{"rendered":"https:\/\/www.ezrasf.com\/wplog\/?p=9290"},"modified":"2019-09-18T14:52:50","modified_gmt":"2019-09-18T18:52:50","slug":"manychat-api-and-suspicious-fb-chat","status":"publish","type":"post","link":"https:\/\/www.ezrasf.com\/wplog\/2019\/09\/18\/manychat-api-and-suspicious-fb-chat\/","title":{"rendered":"Manychat API and suspicious Fb chat"},"content":{"rendered":"
\"16782102211_f64ede5b60_o\"
“apolitik_Magritte”<\/a> by ApolitikNow<\/a> is licensed under CC BY-NC 2.0<\/a><\/figcaption><\/figure>\n

A friend’s Facebook account sent a message with a video link titled, “When was this video?” My hackles were raised because:<\/p>\n

    \n
  1. I rarely get messages from this person.<\/li>\n
  2. It reminded me of the Is This You video Facebook Messenger<\/a> virus.<\/li>\n<\/ol>\n

    If you clicked on either, then go to the link on #2 to get advice on kicking off the program with access to your account.<\/p>\n

    I grabbed the link, https:\/\/mnch.at\/r?act=48a93ac45jkbhf455465548bc&u=236764556620374&p=112045350166462&h=c2446617ed and had wget download the content safely. It took a couple iterations having it ignore the SSL mismatch and supply a “valid” browser user-agent.<\/p>\n

    It looks like this new to me version uses a Web Bot service called Manychat to propagate. mnch.at is a short DNS name for it. That posts to the \/r URI with the act variable. That redirects to Facebook. Unfortunately, the Facebook HTML is obtuse to read, so I stopped here. I miss the days of hackers using simple HTML on compromised web servers.<\/p>\n

    Being able to host it in Facebook makes it more difficult to discover what they are doing.<\/p>\n

    If you go to manychat.com\/r, then it has a redirect to send your browser to Facebook. I’m thinking the hackers are exploiting the trust of manychat to get a way to come to Facebook in a way that looks natural to tools looking to block malicious traffic. Sneaky.<\/p>\n","protected":false},"excerpt":{"rendered":"

    A friend’s Facebook account sent a message with a video link titled, “When was this video?” My hackles were raised because: I rarely get messages from this person. It reminded me of the Is This You video Facebook Messenger virus. If you clicked on either, then go to the link on #2 to get advice […]<\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"jetpack_post_was_ever_published":false,"_jetpack_newsletter_access":"","_jetpack_dont_email_post_to_subs":false,"_jetpack_newsletter_tier_id":0,"_jetpack_memberships_contains_paywalled_content":false,"_jetpack_memberships_contains_paid_content":false,"activitypub_content_warning":"","activitypub_content_visibility":"","activitypub_max_image_attachments":4,"activitypub_interaction_policy_quote":"anyone","activitypub_status":"","footnotes":"","jetpack_publicize_message":"","jetpack_publicize_feature_enabled":true,"jetpack_social_post_already_shared":true,"jetpack_social_options":{"image_generator_settings":{"template":"highway","default_image_id":0,"font":"","enabled":false},"version":2}},"categories":[1],"tags":[],"class_list":["post-9290","post","type-post","status-publish","format-standard","hentry","category-uncategorized"],"jetpack_publicize_connections":[],"jetpack_featured_media_url":"","jetpack_sharing_enabled":true,"jetpack_shortlink":"https:\/\/wp.me\/p1rUBW-2pQ","jetpack-related-posts":[],"jetpack_likes_enabled":true,"_links":{"self":[{"href":"https:\/\/www.ezrasf.com\/wplog\/wp-json\/wp\/v2\/posts\/9290","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.ezrasf.com\/wplog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.ezrasf.com\/wplog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.ezrasf.com\/wplog\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.ezrasf.com\/wplog\/wp-json\/wp\/v2\/comments?post=9290"}],"version-history":[{"count":0,"href":"https:\/\/www.ezrasf.com\/wplog\/wp-json\/wp\/v2\/posts\/9290\/revisions"}],"wp:attachment":[{"href":"https:\/\/www.ezrasf.com\/wplog\/wp-json\/wp\/v2\/media?parent=9290"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.ezrasf.com\/wplog\/wp-json\/wp\/v2\/categories?post=9290"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.ezrasf.com\/wplog\/wp-json\/wp\/v2\/tags?post=9290"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}