Security risk of shorten URL

Introduction

Do you know that shorten URL is as much risky as phishing weblink?

Laymen explanation

If you are a victim of security hack anytime, you must be aware that we should think twice before clicking on any URL mentioned in mail (of-course any other media like whatsapp). So, how to decide if you need to click or not? A suggestion is that you should look at website mentioned in URL to decide if it is reliable. What if website name mentioned in URL is not the actual website?

Technical explanation

Some URLs are extremely long and ungainly, which can make them hard to view on a page.

Platforms such as Twitter have strict character limits that can be quickly eaten up by extended URLs. A truncated URL refers to the same resource but takes far fewer characters to do so. bit.ly and goo.gl like websites provide service to shorten URL.

Since the URL structure doesn't offer any description, it can be hard to tell if the link leads to a legitimate site. Truncated URLs can obfuscate the destination and be a mask for a phishing scam

Apart of this, if service provider is not using strong mechanism to shorten URL, a brute force attack can reveal all the URLs available in this service provider websites. To feel the severity, think that this URL can be shareable link to google document as well.

Some URL shorteners allow the user (that is, the person shortening the URL) to log the target's IP address, even if the reader isn't visiting their site. So it's not a terrible idea to be wary of shortened URLs, even if many are innocuous.

Some known security hacks

The opacity of shortened URLs has been an issue in the past, as Trend Micro's Rik Ferguson pointed out in a blog post.

• • In 2010, malware was discovered by Trend Micro researchers, who found that it used shortened URLs to spam instant messaging services such as Yahoo! Instant Messenger and the now-defunct MSN.

  • In 2012, a Skype worm spread quickly through the use of a shortened URL that led to a compromised file that, when executed, could enlist a PC into a botnet.

  • In 2014, a particular shortened goo.gl URL got a huge number of clicks from people receiving a fraudulent "ACH Notification" email; the link led to a malware-laced ZIP file.

Tips for protection

• • Some services provides the way to preview the destination before clicking. Prefer to use this service. Twitter users can use tools like Tweetdeck. Tweetdeck has an option in the settings to Show preview information for short URL's. With this setting enabled, when you click on a shortened URL within a tweet, a screen will appear that displays the title of the actual destination page, as well as the full-length URL.

  • Firefox browser plugin Long URL Please can prove useful. It automatically converts URLs shortened by over 80 different services so users instead see the full URL. They also provide an API or script that you can incorporate into your own programs for expanding short URLs. This can make it easier for regular Web filtering devices to control access to malicious sites.

  • Wherever, there is no character limit on email messages, so there's no compelling reason to use shortened URLs ( for example, emails).

  • Use reliable anti-malware software. This will scan for many possible security risks associated with such URL.

Reference

https://www.schneier.com/blog/archives/2016/04/security_risks_11.html

http://blog.trendmicro.com/are-shortened-urls-safe/

http://www.forbes.com/forbes/welcome/?toURL=http://www.forbes.com/sites/ygrauer/2016/04/20/five-reasons-you-should-stop-shortening-urls/&refURL=https://www.google.co.in/&referrer=https://www.google.co.in/

https://en.wikipedia.org/wiki/URL_shortening

http://www.pcworld.com/article/184677/URL_Shortening_Frenzy_Comes_with_Security_Risks.html