Shortened URLs are convenient for sharing long Web addresses in email messages and through social media, but at the same time, pose a privacy hazard as the URLs produced by popular services are so short they are vulnerable to brute-force searching, a Cornell Tech research effort found.
In a paper published in April, two researchers revealed that the 5- and 6-character URLs produced by popular shortening services could be easily searched to discover sensitive documents inadvisedly shared by their owners. Attackers could scan shortened URLs at a sustained rate of 2.6 lookups every second, and would only have to pay $36,700 to rent the cloud computing time necessary to do so, co-authors Martin Georgiev and Vitaly Shmatikov stated in the report.
The lesson for users is that the obfuscation of a shortened link does not add security, Shmatikov, a professor of computer science at Cornell Tech, told eWEEK via email.
“When you share a short link, you should assume that you are sharing with everybody … whether it’s [a] OneDrive document or driving directions from your home address,” he said. “When cloud services offer users to generate a short link—like OneDrive did until recently—they should warn the users that by generating the link they are making the content public.”
The researchers found more than 70 million URL mappings on Bit.ly and almost 24 million URL mappings on Google Maps through their technique. To study the privacy implications, the researchers focused on Microsoft’s OneDrive cloud storage offering. They found that nearly 20,000 URLs linked to a file or folder on Microsoft’s OneDrive or SkyDrive service. The accounts could be traversed by anyone with the shortened URL who uses a brute-force search, to discover other files on the sharer’s cloud space.
Many of the accounts allowed anyone with the shortened URL to write to the folder, change a file and save it, raising concerns that attackers could embed malware into the files.
The shortening services need to make the URLs at least eight characters to make the space of all possible URLs computationally difficult to search, Shmatikov said.
“Given computing and scanning capabilities available today, eight characters or longer should be reasonably safe for now,” he said.
After Georgiev and Shmatikov notified Google of the security risk, the company increased the number of characters used by the shortened URLs produced by Google Maps to at least 11. eWEEK confirmed that Google Maps currently assigns shortened URLs of 12 characters.
Microsoft, on the other hand, did not acknowledge the weaknesses, but made two changes: It removed the “shorten link” option from OneDrive and blocked the systematic enumeration of files and folders by users with a shortened link, the researchers said.
“The only change in this respect is that having discovered one shared document; it is no longer trivial to discover all other shared documents in the same account since the account traversal methodology described in the paper no longer seems to work,” Shmatikov said.
Cornell Tech is a New York City-based graduate and research institution founded by Cornell University.