Shortened URLs Make File Sharing Less Secure, Cornell Researchers Find
Attackers can search easily through shortened URL services that use only 5 to 7 characters, producing a small search space, making them vulnerable to brute-force hacking, Cornell researchers discovered.Shortened URLs are convenient for sharing long Web addresses in email messages and through social media, but at the same time, pose a privacy hazard as the URLs produced by popular services are so short they are vulnerable to brute-force searching, a Cornell Tech research effort found. In a paper published in April, two researchers revealed that the 5- and 6-character URLs produced by popular shortening services could be easily searched to discover sensitive documents inadvisedly shared by their owners. Attackers could scan shortened URLs at a sustained rate of 2.6 lookups every second, and would only have to pay $36,700 to rent the cloud computing time necessary to do so, co-authors Martin Georgiev and Vitaly Shmatikov stated in the report. The lesson for users is that the obfuscation of a shortened link does not add security, Shmatikov, a professor of computer science at Cornell Tech, told eWEEK via email. "When you share a short link, you should assume that you are sharing with everybody … whether it’s [a] OneDrive document or driving directions from your home address,” he said. “When cloud services offer users to generate a short link—like OneDrive did until recently—they should warn the users that by generating the link they are making the content public.”
The researchers found more than 70 million URL mappings on Bit.ly and almost 24 million URL mappings on Google Maps through their technique. To study the privacy implications, the researchers focused on Microsoft's OneDrive cloud storage offering. They found that nearly 20,000 URLs linked to a file or folder on Microsoft's OneDrive or SkyDrive service. The accounts could be traversed by anyone with the shortened URL who uses a brute-force search, to discover other files on the sharer's cloud space.