You are in: Articles / Security / Reports / URL shortening: Yet another security risk

URL shortening: Yet another security risk

(Michael Kassner, TechRepublic) URL-shortening services such as TinyURL and are becoming popular attack vectors. You may not want to automatically click on the shortened URL after you read this.
Originally, the process of URL shortening was developed to avoid broken URLs in e-mail messages. The increased popularity of instant messaging (IM) and Twitter has escalated the use of URL-shortening services like TinyURL and, especially Twitter with its 140 characters per message limit.

How they work

TinyURL,, and other Web sites that offer URL shortening are similar in how they work. All that’s required is to:
   1. Go to the respective Web site.
   2. Copy/paste the actual URL into the appropriate field.
   3. Click on Shorten if you want the Web site to append a generic ending on the URL.
   4. If a custom URL is desired, enter your chosen ending and then click on Shorten.
Presto, you have a new shortened URL that has little meaning and isn’t visually related in any way to the official URL.

Potential phishing method
As with many applications that are helpful to normal law-abiding users, attackers and spammers tend to leverage that same usefulness for ill-gotten gain. URL-shortening services provide attackers and spammers with the following options:
   * Allow spammers to side step spam filters as domain names like TinyURL are automatically trusted.
   * Prevent educated users from checking for suspect URLs by obfuscating the actual Web-site URL.
   * Redirect users to phishing sites in order to capture sensitive personal information.
   * Redirect users to malicious sites loaded with drive-by droppers, just waiting to download malware.

As you can see, there are all sorts of opportunities for misuse, just because the victim has no idea where the shortened URL is pointing.

Rating: 12345
Leave a comment

Note: all fields marked with (*) are required
Comments (0)
Close send to email window

Verification code

Already a member?
Blacklist monitoring alerts
sign up Signup for our real-time monitoring service and receive email notifications each time one of your IPs gets blacklisted.
Free Signup
Mail Server Operating System Poll

What OS do you use for your email server?
disabled next

How many mailboxes do you currently manage?
previous next

Would you like to comment upon the choosing of this particular OS?

DNS Tools
Get IP status, owner and location, obtain its corresponding hostname or check specific ports.
Ping Statistics
Reverse DNS Lookup
Whois Info (IP owner)
GeoIP Information
Check Port
Open Relay Test
Test if your mail server is an open relay for spammers.
Blacklist Checker
Check if your IP is listed in DNS based email blacklists (DNSBL)