Slashdot Mirror
Researchers Find Vulnerabilities In Microsoft's and Google's Short URL Services (arstechnica.com)
An anonymous cites an article on Ars Technica: Two security researchers have published research exposing the potential privacy problems connected to using Web address shortening services. When used to share data protected by credentials included in the Web address associated with the content, these services could allow an attacker to gain access to data simply by searching through the entire address space for a URL-shortening service (PDF) in search of content, because of how predictable and short those addresses are. Both Microsoft and Google have offered URL shortening services embedded in various cloud services. Microsoft included the 1drv.ms URL shortening service in its OneDrive cloud storage service and a similar service (binged.it) for Bing Maps -- "branded" domains of the bit.ly domain shortening service. Microsoft has stopped offering the OneDrive embedded shortener, but existing URLs are still accessible. Google Maps has an embedded a tool that creates URLs with the goo.gl domain. Vitaly Shmatikov of Cornell Tech and visiting researcher Martin Georgiev conducted an 18-month study in which they focused on OneDrive and Google Maps. "We did not perform a comprehensive scan of all short URLs (as our analysis shows, such a scan would have been within the capabilities of a more powerful adversary)," Shmatikov wrote in a blog post today, "but we sampled enough to discover interesting information and draw important conclusions." One of those conclusions was that Microsoft's OneDrive shortened URLs were entirely too easy to traverse.
"Researchers Find Privacy Problems In Microsoft's and Google's [Variable] Services" could pretty much be a headline any day...by design.
What is the point of such things? Originally it seemed to be to let people type in such things from a magazine, without causing a half hour, error-prone headache.
That is no longer the case. It is all web magazines and articles and hyperlinks with labels instead of the actual URL. So what is the point?
(-1: Post disagrees with my already-settled worldview) is not a valid mod option.
If you want information to be private, require authentication to access it. The real problem here is that files are shared in the cloud allowing read and, sometimes, write access without requiring authentication. The default needs to be requiring authentication and then prompting the user if they want to change the permissions. Otherwise, you're relying on security through obscurity, which isn't security at all. It's too easy for URLs to end up being found through things like the clipboard and the browser history that nobody should expect them to remain secret. Don't rely on security through obscurity. It doesn't work.
The goo.gl shortener says, right below the URL entry field "All goo.gl URLs and click analytics are public and can be accessed by anyone". I always figured that it was obvious you shouldn't use this sort of service for any URL that needed to be kept secret, and didn't have some additional access control behind it.
I have to log in repeatedly.
Perhaps someone should tell Microsoft that "binged" is already a word, and it's neither pronounced nor defined they way they apparently hope it will be.
> data protected by credentials included in the Web address
You're doing it wrong.
A web address, or URI, is a universal resource IDENTIFIER (or locator, for the older terminology). It specifies which data you wish to access. That's not the place for authentication to be.
Sharing a long URL which includes your user name and password is stupid too.
Who cares? They are URLs. They aren't private.
I am working on implementing something similar. Not an URL shortener, but semi-private shared data with a short URL. My first thought was the risk of someone trying to attack and steal all the records via brute force. Then I decided to track invalid requests and present a CAPTCHA after 3 failed requests from the same IP.
Isn't this easy to solve? Even with a distributed attack, each IP would only get a few hits and it's a large search space. And even if CAPTCHAS are broken, there can be more aggressive measures to follow if invalid requests still come in - including slowing down loading times on flagged IP addresses.
I submitted a Wired article on this topic, but SlashDot mods ignored it and promoted the ArsTechnica version. What's up with all the ArsTechnica shit on this site anyways. You realize there are other sites on the Internet that deliver getter quality right?
http://goo.gl/PQPG
The headline says "Researchers Find Vulnerabilities In Microsoft's and Google's Short URL Services." Regardless of the ability to reverse-guess the shortened URLs, this is really the user's fault.
If a user creates a shortcut that contains their login credentials, then that is their choice. Embedding the credentials into the URL means they are not credentials any longer, they are just part of a long obfuscated URL. Further shortening it completely defeats the purpose.
My own companies short URL system is easy to traverse too... But the short URLs are just that... URLs... Aliases... The data they access still requires auth. Are we really to believe that these short URLs gain backdoor access to things not set to public? Things set to public are whoopie-fkkn-do.
Don't feel bad. I, for one, will tell you that Arstechnica is the BIGGEST SHITHOLE ONLINE there is & their forums are filled with little a-holes the likes of which you would NOT believe...
* 99.999% of them are totally technically inept & the small fraction that DO possess some skills, are only rookie noob menials @ most/best.
APK
P.S.=> As far as this site goes? Many of those little do-nothing trolling "ne'er-do-wells" from ArsSHITnica come here too (albeit mostly under other usernames than they use in their forums, since most of them are pussy weasels)... apk
Sorry, but I don't see how is that news or a secret. Just like tinyurl, the ID of the url is supposed to be as short as possible, hence it is sequential.
The funny thing I found a few years ago was with tinyurl. Apparently, the first links were created by their developers, hence links like tinyurl.com/1 and so on (2,3,...a,b,c...1a,1b) belong to owners of the service and tell something about them.
Therefore link shorteners should have password protection for redirection, at least as an option. For example, as it is done in 2l.lv and similar engines. Also, links should have expiration date, like in owncloud service and limited total number of redirection.