Slashdot Mirror

← Back to Stories (view on slashdot.org)

Spammers Using Shortened .gov URLs

Posted by timothy on from the just-write-to-pueblo-colorado dept.

hypnosec writes "Cyber-scammers have started using '1.usa.gov' links in their spam campaigns in a bid to fool gullible users into thinking that the links they see on a website or have received in their mail or newsletter are legitimate U.S. Government websites. Spammers have created these shortened URLs through a loophole in the URL shortening service provided by bit.ly. USA.gov and bit.ly have collaborated, enabling anyone to shorten a .gov or .mil URL into a 'trustworthy' 1.usa.gov URL. Further, according to an explanation provided by HowTo.gov, creating these usa.gov short URLs does not require a login." Which might not be a big deal, except that the service lets through URLs with embedded redirects, and it is to these redirected addresses that scammers are luring their victims.

8 of 75 comments (clear)

  1. They want all your money... by bradley13 · · Score: 5, Funny

    ...just like other .gov websites

    --
    Enjoy life! This is not a dress rehearsal.
  2. 2*WTF by Anonymous Coward · · Score: 5, Interesting

    Isn't the major WTF in the second stage of the "attack", a .gov site that will happy redirect to _any_ site feed to its (link) script? Obviously the .gov shortening will help in the "attack" on people that do not click everything they see.

    1. Re:2*WTF by rjr162 · · Score: 5, Informative

      That was exactly my thought. The URL shortener may be a f'up having it open like that, but the bigger f'up is the fact the site in the second link allows any address
      For example

      Http://labor.vermont.gov/LinkClick.aspx?link=http://www.slashdot.org

      To me that's the bigger f'up

    2. Re:2*WTF by dingen · · Score: 4, Insightful

      A script called "LinkClick.aspx" which takes a url as argument and forwards the browser to that address. Seriously, what the hell? Do these people know ANYTHING about how the web works? I can't even begin to describe what a load of nonsense such a script is to begin with. How about, oh I don't know, an actual link? Or an HTTP redirect?

      Why the hell was "LinkClick.aspx" even created to begin with? Let alone why it's publicly available and accepts any url. This is so wrong, my head is about to explode.

      --
      Pretty good is actually pretty bad.
    3. Re:2*WTF by dingen · · Score: 4, Insightful

      If it was my job to produce a list of all links, I would scan the site for all links. How about that?

      I really can't believe people who come up with stuff like this... I mean, a script with the ability to redirect to anything a user inputs, that just doesn't make any sense whatsoever.

      --
      Pretty good is actually pretty bad.
    4. Re:2*WTF by Afty0r · · Score: 5, Informative

      It will be for tracking purposes, so that the site owners knows who has clicked on which external links, and from which pages on their site.

      I'm not saying it's a marvel of engineering, but it's a common request from marketers.

    5. Re:2*WTF by hymie! · · Score: 3, Interesting

      Websites seriously implement such a warning?

      Yes. Go to the IRS web site http://www.irs.gov . At the bottom right, where it says "Visit Other Sites", click on "U. S. Treasury" (which, by the way, is the parent organization of the IRS).

  3. Maybe it's just me... by dingen · · Score: 4, Insightful

    ... but a url which starts with "1.usa.gov" doesn't strike me as particularly trustworthy.

    --
    Pretty good is actually pretty bad.