Vulnerabilities / Threats

7/8/2009
02:37 PM
Connect Directly
Google+
LinkedIn
Twitter
RSS
E-Mail
50%
50%

Web Link Shrinkage Powers Spam Surge

The popularity of Twitter has lead to a proliferation of URL shortening services. Now spammers are taking notice and using link reduction to hide spam links.

Concerns raised in April about the security implications of Web link shortening services have proven to be well-founded: The presence of shortened URLs in spam messages has surged in the past week.

Shortened URLs now appear in more than 2% of spam messages, according to MessageLabs. Matt Sergeant, senior anti-spam technologist at the security company, attributes the spike to the development of automated tools for submitting Web links to URL shortening services.

"These services definitely do have a problem with spam links," he said. "What we haven't seen before is the large scale use of URL shortening services in e-mail spam."

Rising usage of sites like Facebook and Twitter, which offer limited-length messaging, has led more people to use services like TinyURL and bit.ly to shrink sprawling online links to a short string of characters. And with usage, investors have followed, allowing bit.ly to raise $2 million in March.

The possibility that these services may someday generate real revenue by serving as middle men between online publishers and Internet users has undeniable business appeal. But the middle man model can be subverted so that it's essentially a man-in-the-middle attack.

A man-in-the-middle attack typically refers to a communications scenario where an attacker relays messages between two parties without their knowledge. Though URL shortening services don't operate covertly, the users of such services may conceal their intent and those clicking on links disguised by such services often don't consider the implications.

"It really breaks down the whole trust model of the URL," said Sergeant. "When you look at a URL you can see, for example, that it points to the New York Times Web site. With these you have no idea where you end up."

Del.icio.us founder Joshua Schachter, now a Google employee, published a blog post in April summarizing several problems surrounding URL shortening services. Beyond issues of poor usability, search rank damage for publishers, and diminished navigability over time, he confirmed that URL shortening services are popular with spammers.

"[A] link that used to be transparent is now opaque and requires a lookup operation," he said. "From my past experience with Del.icio.us, I know that a huge proportion of shortened links are just a disguise for spam, so examining the expanded URL is a necessary step."

Sergeant blames Twitter in part because the service insists on a 140 character limit to accommodate mobile phone messaging conventions. "I personally think the 140 character restriction is a bit ridiculous," he said. "Twitter is partly responsible for this problem. You just can't fit URLs in that space."

Twitter could fetch site names from URLs submitted by users and replace the display text of Twittered links with the destination domain. But doing so would require a lot of behind-the-scenes Web queries, which might require more computing power than the company wants to deploy to address the issue.

Until a technical solution emerges, short URLs are likely to remain risky.

"It's an ongoing problem and it's certainly not going to go away any time soon," said Sergeant.

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Register for Dark Reading Newsletters
Dark Reading Live EVENTS
INsecurity - For the Defenders of Enterprise Security
A Dark Reading Conference
While red team conferences focus primarily on new vulnerabilities and security researchers, INsecurity puts security execution, protection, and operations center stage. The primary speakers will be CISOs and leaders in security defense; the blue team will be the focus.
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: Darn - typed UNICORN instead of UNICODE.  
Current Issue
Security Vulnerabilities: The Next Wave
Just when you thought it was safe, researchers have unveiled a new round of IT security flaws. Is your enterprise ready?
Flash Poll
[Strategic Security Report] How Enterprises Are Attacking the IT Security Problem
[Strategic Security Report] How Enterprises Are Attacking the IT Security Problem
Enterprises are spending more of their IT budgets on cybersecurity technology. How do your organization's security plans and strategies compare to what others are doing? Here's an in-depth look.
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2017-0290
Published: 2017-05-09
NScript in mpengine in Microsoft Malware Protection Engine with Engine Version before 1.1.13704.0, as used in Windows Defender and other products, allows remote attackers to execute arbitrary code or cause a denial of service (type confusion and application crash) via crafted JavaScript code within ...

CVE-2016-10369
Published: 2017-05-08
unixsocket.c in lxterminal through 0.3.0 insecurely uses /tmp for a socket file, allowing a local user to cause a denial of service (preventing terminal launch), or possibly have other impact (bypassing terminal access control).

CVE-2016-8202
Published: 2017-05-08
A privilege escalation vulnerability in Brocade Fibre Channel SAN products running Brocade Fabric OS (FOS) releases earlier than v7.4.1d and v8.0.1b could allow an authenticated attacker to elevate the privileges of user accounts accessing the system via command line interface. With affected version...

CVE-2016-8209
Published: 2017-05-08
Improper checks for unusual or exceptional conditions in Brocade NetIron 05.8.00 and later releases up to and including 06.1.00, when the Management Module is continuously scanned on port 22, may allow attackers to cause a denial of service (crash and reload) of the management module.

CVE-2017-0890
Published: 2017-05-08
Nextcloud Server before 11.0.3 is vulnerable to an inadequate escaping leading to a XSS vulnerability in the search module. To be exploitable a user has to write or paste malicious content into the search dialogue.