URL-shrinking services such as TinyURL.com, bit.ly, and cli.gs are convenient for turning long addresses into short ones. They're also convenient for helping spammers and malware makers hide their identities and guide unwary clickers astray.
URL-shrinking services such as TinyURL.com, bit.ly, and cli.gs are convenient for turning long addresses into short ones. They're also convenient for helping spammers and malware makers hide their identities and guide unwary clickers astray.The surge in shortened-url service popularity has hardly gone unnoticed by spammers and hackers. The reconfigured urls provide a convenient alias tool for spammers casting their nets among Twitter users, for example. Already some observers are tracking large shortened url spam campaigns.
In the course of pointing out that the United States is the world's leading spam generator (we're responsible for one in six spams), security firm Sophos noted the effectiveness of url-shortening "to obscure links to offensive material or malicious websites, and then distribute the links in spam emails, as well as posting them on Twitter and other networks."
The Washington Post's Brian Krebs has a good guide to previewing the true url behind shortened ones here.
Whether or not people in the instantpost/instant response/instant click world of social networking can be persuaded to take the time to preview the actual destination hidden behind a size-reduced url is an important question, one the spammers are betting they know the answer to.
Whether or not you can persuade your employees not to click without looking first is another matter altogether. You can, and the security of your business demands that you must, either by education and policy enforcement, or by prohibiting altogether their use of services that present large and growing security risks.
About the Author(s)
You May Also Like
Guarding the Cloud: Top 5 Cloud Security Hacks and How You Can Avoid Them
April 4, 2024Cybersecurity Strategies for Small and Med Sized Businesses
April 11, 2024Defending Against Today's Threat Landscape with MDR
April 18, 2024Securing Code in the Age of AI
April 24, 2024
Black Hat USA - August 3-8 - Learn More
August 3, 2024Cybersecurity's Hottest New Technologies: What You Need To Know
March 21, 2024Black Hat Asia - April 16-19 - Learn More
April 16, 2024