Spammers Using Shortened .gov URLs
75
hypnosec writes "Cyber-scammers have started using '1.usa.gov' links in their spam campaigns in a bid to fool gullible users into thinking that the links they see on a website or have received in their mail or newsletter are legitimate U.S. Government websites. Spammers have created these shortened URLs through a loophole in the URL shortening service provided by bit.ly. USA.gov and bit.ly have collaborated, enabling anyone to shorten a .gov or .mil URL into a 'trustworthy' 1.usa.gov URL. Further, according to an explanation provided by HowTo.gov, creating these usa.gov short URLs does not require a login." Which might not be a big deal, except that the service lets through URLs with embedded redirects, and it is to these redirected addresses that scammers are luring their victims.
They want all your money... (Score:5, Funny)
...just like other .gov websites [irs.gov]
2*WTF (Score:5, Interesting)
Isn't the major WTF in the second stage of the "attack", a .gov site that will happy redirect to _any_ site feed to its (link) script? Obviously the .gov shortening will help in the "attack" on people that do not click everything they see.
Re:2*WTF (Score:5, Informative)
That was exactly my thought. The URL shortener may be a f'up having it open like that, but the bigger f'up is the fact the site in the second link allows any address
For example
Http://labor.vermont.gov/LinkClick.aspx?link=http://www.slashdot.org
To me that's the bigger f'up
Re: (Score:2)
I'm not sure I'd call it a "f'up" ... imagine if it were your job to maintain a complete authoritative list of every external web site that labor.vermont.gov links to.
It's certainly becoming a problem; I'm just saying that "A page the redirects wherever it needs to redirect to" was probably the goal, not the side-effect.
Re:2*WTF (Score:5, Insightful)
If it was my job to produce a list of all links, I would scan the site for all links. How about that?
I really can't believe people who come up with stuff like this... I mean, a script with the ability to redirect to anything a user inputs, that just doesn't make any sense whatsoever.
Re: (Score:2)
So they can tell if the link is doing any good or not. If nobody clicks on a link, it is a waste and can be replaced by a more useful link or simply removed to make the page simpler.
Re:2*WTF (Score:5, Insightful)
A script called "LinkClick.aspx" which takes a url as argument and forwards the browser to that address. Seriously, what the hell? Do these people know ANYTHING about how the web works? I can't even begin to describe what a load of nonsense such a script is to begin with. How about, oh I don't know, an actual link? Or an HTTP redirect?
Why the hell was "LinkClick.aspx" even created to begin with? Let alone why it's publicly available and accepts any url. This is so wrong, my head is about to explode.
Re:2*WTF (Score:5, Informative)
It will be for tracking purposes, so that the site owners knows who has clicked on which external links, and from which pages on their site.
I'm not saying it's a marvel of engineering, but it's a common request from marketers.
disclaimers (Score:2)
They're not so much used for tracking as popping up "you are now leaving our site, we're not responsible for this content" advisories. I have yet to see a US government agency website that doesn't do this - and they're virtually the only ones who do.
Re: (Score:2)
Re: (Score:2)
Re: (Score:2, Interesting)
I would guess that LinkClick.aspx was created to track outbound links from the site.
That way they can easily create statistics on what links people click on.
It is a lazy way to do it to avoid having to keep track of which links you want to track.
Everyone does it, even google search. Although some are doing it in a good way and keep track of what they allow to redirect, not just allow anything.
Re: (Score:2)
The reason Google does this, is because they check if the website is listed as fraudulent and displays a warning if that is the case. But on your own website, you don't have to implement such functionality as you probably have a lot of control over what you link to in the first place.
I get the wish to track outbound links, but seriously, this is not the way to do it.
Re: (Score:1)
Google could add redirection only to links which are suspected to lead to fraudulent sites, but they add redirection to all links. They do it for the same reason everybody else does it: To track what you clicked.
Re: (Score:2)
It was probably created for tracking purposes, the same way that clicking on an unmodified Google search result also takes you to a redirect url.
Why the hell was "LinkClick.aspx" created? (Score:1)
It tracks the links that a user clicks on:
When you browse any web site, one log file entry is created for every page you visit --- with the information where you came from. When you follow a link from one web site "A.gov" to another web site "B.com", then this data would be stored in the log file of "B.com" --- but not in the log files of "A.gov".
By jumping through the LinkClick.aspx script, the site "A.gov" catches this information (where do our visitors go to?) in their log files.
Re: (Score:2)
It's usually for either tracking, or for displaying a disclaimer "You are about to leave our web site. Nothing you see is under our control. Do you wish to continue?"
Re: (Score:2)
Websites seriously implement such a warning? Wow... I'm truly amazed by the craziness of this entire thread.
Re:2*WTF (Score:4, Interesting)
Websites seriously implement such a warning?
Yes. Go to the IRS web site http://www.irs.gov . At the bottom right, where it says "Visit Other Sites", click on "U. S. Treasury" (which, by the way, is the parent organization of the IRS).
Re: (Score:3)
That really is quite ridiculous. But at least don't they don't allow just any url in their redirection script, I guess that's something...
Re: (Score:3)
Re: (Score:2)
You should make a YouTube video about that. I bet it will get lots of comments.
Remember that lame late 70s/early 80s video technique where you'd point a camcorder into a TV monitor and get the endless recursion effect? Hey, it'd be more interesting than that YT vid that takes 571 hours [youtube.com] to watch.
Re: (Score:2)
Re: (Score:2)
About 53,400 results
Good luck blacklisting all of them, USA.gov...
USA.gov should have its right to operate a website revoked, it's at least as culpable as any of the idiots who implement the link-following on their
Re: (Score:2)
Re: (Score:2)
Re: (Score:3)
Google or Slashdot? [google.com] If you try to alter it I believe Google gives you a redirect warning. But as long as you can find your site through Google you can create a link that looks like it goes to Google but goes wherever you want.
Re: (Score:2)
Http://labor.vermont.gov/LinkClick.aspx?link=http://www.slashdot.org
To me that's the bigger f'up
Why is that?
Suppose you want an efficient way of tracking which external links visitors of your site are clicking on. A script such as LinkClick.aspx is a reasonable way of achieving that.
Limiting LinkClick.aspx to a specific list of URLs adds extra unnecessary maintenance work, and it's really not an issue to allow you to redirect yourself to any site.
Assuming there's no f'up such as 1.usa.gov all
Re: (Score:1)
Don't act so shocked. There are redirection URLs out the wazoo. Even CNN had a story [cnn.com] about them.
Re: (Score:2)
I agree, however, 1.usa.gov can mitigate this attack by checking each link for a redirect before accepting it into their database.
What else would you expect? (Score:1)
Impersonating a Government Agency... (Score:1)
Re: (Score:1)
dude, maybe for fucking ONCE the FBI will have something on their to do list that has some social value. cross your fingers noobz, some fucking spammers gonna go to PMITA prison.
Re: (Score:2)
Maybe it's just me... (Score:5, Insightful)
... but a url which starts with "1.usa.gov" doesn't strike me as particularly trustworthy.
Re: (Score:3)
But the government does it's job so competently everywhere else!
Re: (Score:3)
Try whitehouse.com [whitehouse.com]. Not much going on there these days either.
Re: (Score:2)
... but a url which starts with "1.usa.gov" doesn't strike me as particularly trustworthy.
I just don't trust anything from the government, so I'm safe.
Plus, the gov doesn't have my email address unless it been harvesting them.
Re: (Score:3)
True, but something like ''FedWorld' sounds like an obvious scam too. The thing is, obvious scams are obvious because it's easy to detect the incompetence, but then you try to apply that to government, and all bets are off.
Oh wow, now it makes sense (Score:2, Interesting)
I've been getting spams from IRS.gov. First the content doesn't apply to me, and they are grammatically incorrect. But I can see somebody being fooled. The URL is .irs.gov/get action.aspx. Seeing IRS.gov makes it seem real. Knowing better stops me from clicking the link (but I want to, just to see what it does).
I thought it might be a SQL injection hack. Great, now there are more .gov attacks, built by the govt.
What will they think of next?
Who in the FedGov is using Bit.ly? (Score:2)
Admittedly, before go.usa.gov went live I needed to use a shortening service on occasion, but I always used tinyurl preview links when that came up. I figured that it was the least I could do to improve transparency for users.
The Simple Answer (Score:2, Funny)
Everyone is responsible for knowing where they are clicking through to. Nobody bothers to check the actual target URL. A simple answer is:
1. Turn on the status bar at the bottom of the browser window.[usually View/Toolbars/Status Bar (checkbox)]
2. Each URL pointed to will show the actual target in the status bar.
3. Make sure that's really where you want to go, and DON'T click if you don't recognise the URL shown there.
Re: (Score:2)
I like how this is modded funny, because overriding the status bar is something even Google does with its search results to hide that every link is actually a redirect.
URL shortners should be dismissed as spam (Score:2)
There is no reason an e-mail needs to contain a obfuscated link. Its either a bound through some marketing tracking crap (therefore is spam) or it might be malicous. The best way to approach this is just start dropping mails that contain links with the URL of any known shorteners.
It won't take long for legitimate and semi-legitimate senders to realize they just can't use such links because it means their messages don't get past recipient spam filters. Honestly from a security standpoint I can't see why i
Re: (Score:2)
If you need to email people that can't handle linebreaks that break long links on the receiving end, URL shorteners are a godsend.
Government IT... (Score:1)
There are better ways than LinkClick.aspx (Score:1)
For those who said such an implementation has its legitimate use:
It is stupid. Period.
Write a simple "onclick" javascript, and the webpage can ping back all external links to its own server for whatever statistics purpose. Using redirect links for statistical purpose is NEVER necessary.
Also, waiting for those slow servers to reponse and redirect their redirection link is annoying. Just give me the site I am going to anyway please!
I have one of these scripts on my web site. (Score:1)
I have one of these scripts on my web site. It isn't there to track if people click the links. It's to allow me to link to shady web sites without Google knowing that I'm linking to shady web sites and penalizing me for doing so. (They are useful for discussion sometimes.) The script itself is blocked by robots.txt, and so Google never sees that there's a redirect that points to the web site since it never makes a request to the script, whereas simply using a nofollow tag would still allow Google to kno
So, I want to know... (Score:1)
when the world is going to say "enough is enough" with these vermin, and drop them in some sort of Escape From NY type of gulag.
The world has enough problems facing it without these walking human cancers wreaking financial and technological destruction in their path.
Oh, I forgot all of our prison spaces are full of people enjoying natural herbs, silly, me, I forgot about such high-priority things like that.