Vulnerabilities / Threats
7/8/2009
02:37 PM
Connect Directly
Google+
LinkedIn
Twitter
RSS
E-Mail
50%
50%

Web Link Shrinkage Powers Spam Surge

The popularity of Twitter has lead to a proliferation of URL shortening services. Now spammers are taking notice and using link reduction to hide spam links.

Concerns raised in April about the security implications of Web link shortening services have proven to be well-founded: The presence of shortened URLs in spam messages has surged in the past week.

Shortened URLs now appear in more than 2% of spam messages, according to MessageLabs. Matt Sergeant, senior anti-spam technologist at the security company, attributes the spike to the development of automated tools for submitting Web links to URL shortening services.

"These services definitely do have a problem with spam links," he said. "What we haven't seen before is the large scale use of URL shortening services in e-mail spam."

Rising usage of sites like Facebook and Twitter, which offer limited-length messaging, has led more people to use services like TinyURL and bit.ly to shrink sprawling online links to a short string of characters. And with usage, investors have followed, allowing bit.ly to raise $2 million in March.

The possibility that these services may someday generate real revenue by serving as middle men between online publishers and Internet users has undeniable business appeal. But the middle man model can be subverted so that it's essentially a man-in-the-middle attack.

A man-in-the-middle attack typically refers to a communications scenario where an attacker relays messages between two parties without their knowledge. Though URL shortening services don't operate covertly, the users of such services may conceal their intent and those clicking on links disguised by such services often don't consider the implications.

"It really breaks down the whole trust model of the URL," said Sergeant. "When you look at a URL you can see, for example, that it points to the New York Times Web site. With these you have no idea where you end up."

Del.icio.us founder Joshua Schachter, now a Google employee, published a blog post in April summarizing several problems surrounding URL shortening services. Beyond issues of poor usability, search rank damage for publishers, and diminished navigability over time, he confirmed that URL shortening services are popular with spammers.

"[A] link that used to be transparent is now opaque and requires a lookup operation," he said. "From my past experience with Del.icio.us, I know that a huge proportion of shortened links are just a disguise for spam, so examining the expanded URL is a necessary step."

Sergeant blames Twitter in part because the service insists on a 140 character limit to accommodate mobile phone messaging conventions. "I personally think the 140 character restriction is a bit ridiculous," he said. "Twitter is partly responsible for this problem. You just can't fit URLs in that space."

Twitter could fetch site names from URLs submitted by users and replace the display text of Twittered links with the destination domain. But doing so would require a lot of behind-the-scenes Web queries, which might require more computing power than the company wants to deploy to address the issue.

Until a technical solution emerges, short URLs are likely to remain risky.

"It's an ongoing problem and it's certainly not going to go away any time soon," said Sergeant.

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-7896
Published: 2015-03-03
Multiple cross-site scripting (XSS) vulnerabilities in HP XP P9000 Command View Advanced Edition Software Online Help, as used in HP Device Manager 6.x through 8.x before 8.1.2-00, HP XP P9000 Tiered Storage Manager 6.x through 8.x before 8.1.2-00, HP XP P9000 Replication Manager 6.x and 7.x before ...

CVE-2014-9283
Published: 2015-03-03
The BestWebSoft Captcha plugin before 4.0.7 for WordPress allows remote attackers to bypass the CAPTCHA protection mechanism and obtain administrative access via unspecified vectors.

CVE-2014-9683
Published: 2015-03-03
Off-by-one error in the ecryptfs_decode_from_filename function in fs/ecryptfs/crypto.c in the eCryptfs subsystem in the Linux kernel before 3.18.2 allows local users to cause a denial of service (buffer overflow and system crash) or possibly gain privileges via a crafted filename.

CVE-2015-0656
Published: 2015-03-03
Cross-site scripting (XSS) vulnerability in the login page in Cisco Network Analysis Module (NAM) allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, aka Bug ID CSCum81269.

CVE-2015-0890
Published: 2015-03-03
The BestWebSoft Google Captcha (aka reCAPTCHA) plugin before 1.13 for WordPress allows remote attackers to bypass the CAPTCHA protection mechanism and obtain administrative access via unspecified vectors.

Dark Reading Radio
Archived Dark Reading Radio
How can security professionals better engage with their peers, both in person and online? In this Dark Reading Radio show, we will talk to leaders at some of the security industry’s professional organizations about how security pros can get more involved – with their colleagues in the same industry, with their peers in other industries, and with the IT security community as a whole.