Hacked URL Shortener Redirects 2.2 Million Links
If you haven't taken the security warnings over truncated URLs on social networks seriously, then take a look at this hack. Cligs, a service that shortens URLs for redistribution by users, was hacked and had 2.2 million links redirected to a single URL hosted by freedomblogging.com. According to a blog post on Clig's site, the breach was discovered Monday and appears to have happened sometime over the weekend. Cligs, which competes with other popular URL shortening services such as TinyURL, bit.ly and ReadThisURL, says it closed the vulnerability that allowed the hacker access and is in the process of restoring the routing for all of the effected links. The service says the restoration of URL routing probably won't be complete, since the last backup it has is from May. That means a fairly large percentage of the most recent URLs shortened by the service will lead to dead ends. Security experts have issued warnings about the threat of shortened URLs, since they often obscure the source domain. Users often cannot tell where a shortened URL will take them until they click on the link and arrive at their destination. Security experts say many shortened URLs attached to enticing messages of social networking sites are actually bait to malicious or compromised Websites that contain auto-downloading malware. The Clig's hack shows that hackers are increasingly more aggressive in trapping Web users and are moving beyond passive mechanisms such as phishing and spam to get users to their sites. A recent study by CompTIA shows that businesses are increasingly worried about human error in causing security incidences and violations. Those same organizations are also giving less support for non-IT user awareness training. The Cligs incident shows the need for raising awareness about this new attack vector that can entrap even the most savvy Web user. |
