Slashdot Mirror
Spammers Using Shortened .gov URLs
hypnosec writes "Cyber-scammers have started using '1.usa.gov' links in their spam campaigns in a bid to fool gullible users into thinking that the links they see on a website or have received in their mail or newsletter are legitimate U.S. Government websites. Spammers have created these shortened URLs through a loophole in the URL shortening service provided by bit.ly. USA.gov and bit.ly have collaborated, enabling anyone to shorten a .gov or .mil URL into a 'trustworthy' 1.usa.gov URL. Further, according to an explanation provided by HowTo.gov, creating these usa.gov short URLs does not require a login." Which might not be a big deal, except that the service lets through URLs with embedded redirects, and it is to these redirected addresses that scammers are luring their victims.
...just like other .gov websites
Enjoy life! This is not a dress rehearsal.
Isn't the major WTF in the second stage of the "attack", a .gov site that will happy redirect to _any_ site feed to its (link) script? Obviously the .gov shortening will help in the "attack" on people that do not click everything they see.
...will get you real federal prison time. http://www.law.cornell.edu/uscode/text/18/912
... but a url which starts with "1.usa.gov" doesn't strike me as particularly trustworthy.
Pretty good is actually pretty bad.
It tracks the links that a user clicks on:
When you browse any web site, one log file entry is created for every page you visit --- with the information where you came from. When you follow a link from one web site "A.gov" to another web site "B.com", then this data would be stored in the log file of "B.com" --- but not in the log files of "A.gov".
By jumping through the LinkClick.aspx script, the site "A.gov" catches this information (where do our visitors go to?) in their log files.
I've been getting spams from IRS.gov. First the content doesn't apply to me, and they are grammatically incorrect. But I can see somebody being fooled. The URL is .irs.gov/get action.aspx. Seeing IRS.gov makes it seem real. Knowing better stops me from clicking the link (but I want to, just to see what it does).
I thought it might be a SQL injection hack. Great, now there are more .gov attacks, built by the govt.
What will they think of next?
Admittedly, before go.usa.gov went live I needed to use a shortening service on occasion, but I always used tinyurl preview links when that came up. I figured that it was the least I could do to improve transparency for users.
Stop learning! Only you can prevent esoterrorism.
Everyone is responsible for knowing where they are clicking through to. Nobody bothers to check the actual target URL. A simple answer is:
1. Turn on the status bar at the bottom of the browser window.[usually View/Toolbars/Status Bar (checkbox)]
2. Each URL pointed to will show the actual target in the status bar.
3. Make sure that's really where you want to go, and DON'T click if you don't recognise the URL shown there.
They're not so much used for tracking as popping up "you are now leaving our site, we're not responsible for this content" advisories. I have yet to see a US government agency website that doesn't do this - and they're virtually the only ones who do.
Please help metamoderate.
There is no reason an e-mail needs to contain a obfuscated link. Its either a bound through some marketing tracking crap (therefore is spam) or it might be malicous. The best way to approach this is just start dropping mails that contain links with the URL of any known shorteners.
It won't take long for legitimate and semi-legitimate senders to realize they just can't use such links because it means their messages don't get past recipient spam filters. Honestly from a security standpoint I can't see why it should ever be considered okay to follow an obfuscated link in an otherwise unauthenticated and untrusted document like an E-mail. We spend years trying to teach people not to click links in mails without checking they point where the display text says they do first and stupid bit.ly came along and make that impossible for most users.
Now maybe if the message is signed and the spam gateway can verify the signature belongs to someone or some entity on the white list fine, but otherwise discard. As network and mail admins I think we owe it to our users to take hard line against this practice.
Repeal the 17th Amendment TODAY! Also Please Read http://www.gnu.org/philosophy/right-to-read.html
Government IT of any kind is mostly inept. I used to work on government systems and holy hell were they buggy and prone to downtime.
So they can tell if the link is doing any good or not. If nobody clicks on a link, it is a waste and can be replaced by a more useful link or simply removed to make the page simpler.
For those who said such an implementation has its legitimate use:
It is stupid. Period.
Write a simple "onclick" javascript, and the webpage can ping back all external links to its own server for whatever statistics purpose. Using redirect links for statistical purpose is NEVER necessary.
Also, waiting for those slow servers to reponse and redirect their redirection link is annoying. Just give me the site I am going to anyway please!
when the world is going to say "enough is enough" with these vermin, and drop them in some sort of Escape From NY type of gulag.
The world has enough problems facing it without these walking human cancers wreaking financial and technological destruction in their path.
Oh, I forgot all of our prison spaces are full of people enjoying natural herbs, silly, me, I forgot about such high-priority things like that.
I have one of these scripts on my web site. It isn't there to track if people click the links. It's to allow me to link to shady web sites without Google knowing that I'm linking to shady web sites and penalizing me for doing so. (They are useful for discussion sometimes.) The script itself is blocked by robots.txt, and so Google never sees that there's a redirect that points to the web site since it never makes a request to the script, whereas simply using a nofollow tag would still allow Google to know about the link's existence, even if it doesn't follow the link.