Spammers Exploit Shortened URLs
By Anna Johnson on July 13th, 2009Research by MessageLabs, a division of Symantec, indicates that spammers’ use of shortened URLs such as Bit.ly has skyrocketed in just the last few days. MessageLabs estimates that shortened URLs now appear in over 2 percent of all spam.
According to MessageLabs, the emergence of so many easy-to-use URL shortening services has allowed spammers to evade spam filters that recognize web domains or URLs known for sending spam. Consequently, spammers are increasingly using shortened URLs to hide and redirect people to their destination URLs.
In particular, URL shortening services have made spammers’ lives easier than ever. Spammers can now generate URLs without having to register anywhere, having to create redirect websites, or go through other steps to mask their true domains.
According to Message Labs’ anti-spam technologist, Matt Sergeant, the common use of shortened URLs on Twitter – where people customarily retweet links without necessarily clicking on them – has and will only perpetuate the spam problem.
“The entire trust model of clicking on the URL is completely broken,” he said. “You can’t trust any URL on there.”
If this trend continues you can expect the spam filters to end up flagging all shortened URLs as risky, which in turn will detract from their usage.
Once again, spammers ruin things for everyone.
Source: Brad Stone, “Spammers Shorten Their URLs,” The New York Times, July 7, 2009
July 13th, 2009 at 11:16 am
URL shorteners will have to do more security checks on each link: look for phishing sites, spam, XSS, malware, etc. like Safe.mn (http://safe.mn/) already does. Once the URL shorteners are secure, users won’t have to worry about clicking on short links, knowing that bad links are filtered.