Vulnerabilities / Threats
7/8/2009
02:37 PM
Connect Directly
LinkedIn
Twitter
Google+
RSS
E-Mail
50%
50%

Web Link Shrinkage Powers Spam Surge

The popularity of Twitter has lead to a proliferation of URL shortening services. Now spammers are taking notice and using link reduction to hide spam links.

Concerns raised in April about the security implications of Web link shortening services have proven to be well-founded: The presence of shortened URLs in spam messages has surged in the past week.

Shortened URLs now appear in more than 2% of spam messages, according to MessageLabs. Matt Sergeant, senior anti-spam technologist at the security company, attributes the spike to the development of automated tools for submitting Web links to URL shortening services.

"These services definitely do have a problem with spam links," he said. "What we haven't seen before is the large scale use of URL shortening services in e-mail spam."

Rising usage of sites like Facebook and Twitter, which offer limited-length messaging, has led more people to use services like TinyURL and bit.ly to shrink sprawling online links to a short string of characters. And with usage, investors have followed, allowing bit.ly to raise $2 million in March.

The possibility that these services may someday generate real revenue by serving as middle men between online publishers and Internet users has undeniable business appeal. But the middle man model can be subverted so that it's essentially a man-in-the-middle attack.

A man-in-the-middle attack typically refers to a communications scenario where an attacker relays messages between two parties without their knowledge. Though URL shortening services don't operate covertly, the users of such services may conceal their intent and those clicking on links disguised by such services often don't consider the implications.

"It really breaks down the whole trust model of the URL," said Sergeant. "When you look at a URL you can see, for example, that it points to the New York Times Web site. With these you have no idea where you end up."

Del.icio.us founder Joshua Schachter, now a Google employee, published a blog post in April summarizing several problems surrounding URL shortening services. Beyond issues of poor usability, search rank damage for publishers, and diminished navigability over time, he confirmed that URL shortening services are popular with spammers.

"[A] link that used to be transparent is now opaque and requires a lookup operation," he said. "From my past experience with Del.icio.us, I know that a huge proportion of shortened links are just a disguise for spam, so examining the expanded URL is a necessary step."

Sergeant blames Twitter in part because the service insists on a 140 character limit to accommodate mobile phone messaging conventions. "I personally think the 140 character restriction is a bit ridiculous," he said. "Twitter is partly responsible for this problem. You just can't fit URLs in that space."

Twitter could fetch site names from URLs submitted by users and replace the display text of Twittered links with the destination domain. But doing so would require a lot of behind-the-scenes Web queries, which might require more computing power than the company wants to deploy to address the issue.

Until a technical solution emerges, short URLs are likely to remain risky.

"It's an ongoing problem and it's certainly not going to go away any time soon," said Sergeant.

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Flash Poll
Current Issue
Cartoon
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-4725
Published: 2014-07-27
The MailPoet Newsletters (wysija-newsletters) plugin before 2.6.7 for WordPress allows remote attackers to bypass authentication and execute arbitrary PHP code by uploading a crafted theme using wp-admin/admin-post.php and accessing the theme in wp-content/uploads/wysija/themes/mailp/.

CVE-2014-4726
Published: 2014-07-27
Unspecified vulnerability in the MailPoet Newsletters (wysija-newsletters) plugin before 2.6.8 for WordPress has unspecified impact and attack vectors.

CVE-2014-2363
Published: 2014-07-26
Morpho Itemiser 3 8.17 has hardcoded administrative credentials, which makes it easier for remote attackers to obtain access via a login request.

CVE-2014-2625
Published: 2014-07-26
Directory traversal vulnerability in the storedNtxFile function in HP Network Virtualization 8.6 (aka Shunra Network Virtualization) allows remote attackers to read arbitrary files via crafted input, aka ZDI-CAN-2023.

CVE-2014-2626
Published: 2014-07-26
Directory traversal vulnerability in the toServerObject function in HP Network Virtualization 8.6 (aka Shunra Network Virtualization) allows remote attackers to create files, and consequently execute arbitrary code, via crafted input, aka ZDI-CAN-2024.

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
Sara Peters hosts a conversation on Botnets and those who fight them.