Forgot your password?
typodupeerror
Government Spam United States IT

Spammers Using Shortened .gov URLs 75

Posted by timothy
from the just-write-to-pueblo-colorado dept.
hypnosec writes "Cyber-scammers have started using '1.usa.gov' links in their spam campaigns in a bid to fool gullible users into thinking that the links they see on a website or have received in their mail or newsletter are legitimate U.S. Government websites. Spammers have created these shortened URLs through a loophole in the URL shortening service provided by bit.ly. USA.gov and bit.ly have collaborated, enabling anyone to shorten a .gov or .mil URL into a 'trustworthy' 1.usa.gov URL. Further, according to an explanation provided by HowTo.gov, creating these usa.gov short URLs does not require a login." Which might not be a big deal, except that the service lets through URLs with embedded redirects, and it is to these redirected addresses that scammers are luring their victims.
This discussion has been archived. No new comments can be posted.

Spammers Using Shortened .gov URLs

Comments Filter:
  • 2*WTF (Score:5, Interesting)

    by Anonymous Coward on Sunday October 21, 2012 @07:24AM (#41720819)

    Isn't the major WTF in the second stage of the "attack", a .gov site that will happy redirect to _any_ site feed to its (link) script? Obviously the .gov shortening will help in the "attack" on people that do not click everything they see.

    • Re:2*WTF (Score:5, Informative)

      by rjr162 (69736) on Sunday October 21, 2012 @07:38AM (#41720861)

      That was exactly my thought. The URL shortener may be a f'up having it open like that, but the bigger f'up is the fact the site in the second link allows any address
      For example

      Http://labor.vermont.gov/LinkClick.aspx?link=http://www.slashdot.org

      To me that's the bigger f'up

      • by hymie! (95907)

        I'm not sure I'd call it a "f'up" ... imagine if it were your job to maintain a complete authoritative list of every external web site that labor.vermont.gov links to.

        It's certainly becoming a problem; I'm just saying that "A page the redirects wherever it needs to redirect to" was probably the goal, not the side-effect.

        • Re:2*WTF (Score:5, Insightful)

          by dingen (958134) on Sunday October 21, 2012 @08:30AM (#41720985)

          If it was my job to produce a list of all links, I would scan the site for all links. How about that?

          I really can't believe people who come up with stuff like this... I mean, a script with the ability to redirect to anything a user inputs, that just doesn't make any sense whatsoever.

      • Re:2*WTF (Score:5, Insightful)

        by dingen (958134) on Sunday October 21, 2012 @08:21AM (#41720965)

        A script called "LinkClick.aspx" which takes a url as argument and forwards the browser to that address. Seriously, what the hell? Do these people know ANYTHING about how the web works? I can't even begin to describe what a load of nonsense such a script is to begin with. How about, oh I don't know, an actual link? Or an HTTP redirect?

        Why the hell was "LinkClick.aspx" even created to begin with? Let alone why it's publicly available and accepts any url. This is so wrong, my head is about to explode.

        • Re:2*WTF (Score:5, Informative)

          by Afty0r (263037) on Sunday October 21, 2012 @08:51AM (#41721059) Homepage

          It will be for tracking purposes, so that the site owners knows who has clicked on which external links, and from which pages on their site.

          I'm not saying it's a marvel of engineering, but it's a common request from marketers.

          • They're not so much used for tracking as popping up "you are now leaving our site, we're not responsible for this content" advisories. I have yet to see a US government agency website that doesn't do this - and they're virtually the only ones who do.

          • The usual way to implement that sort of tracking is by having a list of sensible URLs to track in the database and redirecting *only* those.
        • Re: (Score:2, Interesting)

          by Anonymous Coward

          I would guess that LinkClick.aspx was created to track outbound links from the site.
          That way they can easily create statistics on what links people click on.

          It is a lazy way to do it to avoid having to keep track of which links you want to track.
          Everyone does it, even google search. Although some are doing it in a good way and keep track of what they allow to redirect, not just allow anything.

          • by dingen (958134)

            The reason Google does this, is because they check if the website is listed as fraudulent and displays a warning if that is the case. But on your own website, you don't have to implement such functionality as you probably have a lot of control over what you link to in the first place.

            I get the wish to track outbound links, but seriously, this is not the way to do it.

            • by Anonymous Coward

              Google could add redirection only to links which are suspected to lead to fraudulent sites, but they add redirection to all links. They do it for the same reason everybody else does it: To track what you clicked.

        • It was probably created for tracking purposes, the same way that clicking on an unmodified Google search result also takes you to a redirect url.

        • by Anonymous Coward

          It tracks the links that a user clicks on:

          When you browse any web site, one log file entry is created for every page you visit --- with the information where you came from. When you follow a link from one web site "A.gov" to another web site "B.com", then this data would be stored in the log file of "B.com" --- but not in the log files of "A.gov".

          By jumping through the LinkClick.aspx script, the site "A.gov" catches this information (where do our visitors go to?) in their log files.

        • by hymie! (95907)

          It's usually for either tracking, or for displaying a disclaimer "You are about to leave our web site. Nothing you see is under our control. Do you wish to continue?"

          • by dingen (958134)

            Websites seriously implement such a warning? Wow... I'm truly amazed by the craziness of this entire thread.

            • Re:2*WTF (Score:4, Interesting)

              by hymie! (95907) on Sunday October 21, 2012 @09:20AM (#41721189)

              Websites seriously implement such a warning?

              Yes. Go to the IRS web site http://www.irs.gov . At the bottom right, where it says "Visit Other Sites", click on "U. S. Treasury" (which, by the way, is the parent organization of the IRS).

              • by dingen (958134)

                That really is quite ridiculous. But at least don't they don't allow just any url in their redirection script, I guess that's something...

            • by fatphil (181876)
              For me, when I click on a link to a youtube video from within a comment on a youtube video, youtube warns me that I'm about to leave youtube, and be redirected to youtube, asking me if I really want to do that.
              • You should make a YouTube video about that. I bet it will get lots of comments.

                Remember that lame late 70s/early 80s video technique where you'd point a camcorder into a TV monitor and get the endless recursion effect? Hey, it'd be more interesting than that YT vid that takes 571 hours [youtube.com] to watch.

          • by deniable (76198)
            Don't forget opening a new window. There are still sites that hate the back button.
        • by fatphil (181876)
          Google for ``inurl:.gov?LinkClick.aspx?link=''

          About 53,400 results

          Good luck blacklisting all of them, USA.gov...

          USA.gov should have its right to operate a website revoked, it's at least as culpable as any of the idiots who implement the link-following on their .gov site, as it presumes there are no idiots with .gov domains.
          • by fatphil (181876)
            Actually a fair chunk of those hits are not troublesome ones as google's not very good at working out what I was searching for. However, there are plenty of link= redicts all over the whole gamut of .gov domains. I haven't found any .mil use of the redirect yet, but I'm sure some exist.
        • by bhcompy (1877290)
          Most link aggregators I know of use the same technique
      • Google search results are all redirects.

        Google or Slashdot? [google.com] If you try to alter it I believe Google gives you a redirect warning. But as long as you can find your site through Google you can create a link that looks like it goes to Google but goes wherever you want.
      • by mysidia (191772)

        Http://labor.vermont.gov/LinkClick.aspx?link=http://www.slashdot.org
        To me that's the bigger f'up

        Why is that?

        Suppose you want an efficient way of tracking which external links visitors of your site are clicking on. A script such as LinkClick.aspx is a reasonable way of achieving that.

        Limiting LinkClick.aspx to a specific list of URLs adds extra unnecessary maintenance work, and it's really not an issue to allow you to redirect yourself to any site.

        Assuming there's no f'up such as 1.usa.gov all

    • by Anonymous Coward

      Don't act so shocked. There are redirection URLs out the wazoo. Even CNN had a story [cnn.com] about them.

    • by flonker (526111)

      I agree, however, 1.usa.gov can mitigate this attack by checking each link for a redirect before accepting it into their database.

  • It's obviously a Libyan plot.
  • ...will get you real federal prison time. http://www.law.cornell.edu/uscode/text/18/912 [cornell.edu]
    • by Anonymous Coward

      dude, maybe for fucking ONCE the FBI will have something on their to do list that has some social value. cross your fingers noobz, some fucking spammers gonna go to PMITA prison.

      • by jythie (914043)
        Spamming is too profitable, and thus going after it would 'hurt the economy'.
  • by dingen (958134) on Sunday October 21, 2012 @08:39AM (#41721011)

    ... but a url which starts with "1.usa.gov" doesn't strike me as particularly trustworthy.

    • by MightyYar (622222)

      But the government does it's job so competently everywhere else!

    • by Nyder (754090)

      ... but a url which starts with "1.usa.gov" doesn't strike me as particularly trustworthy.

      I just don't trust anything from the government, so I'm safe.

      Plus, the gov doesn't have my email address unless it been harvesting them.

    • True, but something like ''FedWorld' sounds like an obvious scam too. The thing is, obvious scams are obvious because it's easy to detect the incompetence, but then you try to apply that to government, and all bets are off.

  • by Anonymous Coward

    I've been getting spams from IRS.gov. First the content doesn't apply to me, and they are grammatically incorrect. But I can see somebody being fooled. The URL is .irs.gov/get action.aspx. Seeing IRS.gov makes it seem real. Knowing better stops me from clicking the link (but I want to, just to see what it does).

    I thought it might be a SQL injection hack. Great, now there are more .gov attacks, built by the govt.

    What will they think of next?

  • This seems like a terrible idea. I wouldn't touch Bit.ly for something official at work now that go.usa.gov is live. That requires a federal gov't e-mail address as a login, and people abusing the system can be stopped at the account level.

    Admittedly, before go.usa.gov went live I needed to use a shortening service on occasion, but I always used tinyurl preview links when that came up. I figured that it was the least I could do to improve transparency for users.

  • by Anonymous Coward

    Everyone is responsible for knowing where they are clicking through to. Nobody bothers to check the actual target URL. A simple answer is:
    1. Turn on the status bar at the bottom of the browser window.[usually View/Toolbars/Status Bar (checkbox)]
    2. Each URL pointed to will show the actual target in the status bar.
    3. Make sure that's really where you want to go, and DON'T click if you don't recognise the URL shown there.

    • by pod (1103)

      I like how this is modded funny, because overriding the status bar is something even Google does with its search results to hide that every link is actually a redirect.

  • There is no reason an e-mail needs to contain a obfuscated link. Its either a bound through some marketing tracking crap (therefore is spam) or it might be malicous. The best way to approach this is just start dropping mails that contain links with the URL of any known shorteners.

    It won't take long for legitimate and semi-legitimate senders to realize they just can't use such links because it means their messages don't get past recipient spam filters. Honestly from a security standpoint I can't see why i

    • by jackbird (721605)

      If you need to email people that can't handle linebreaks that break long links on the receiving end, URL shorteners are a godsend.

  • Government IT of any kind is mostly inept. I used to work on government systems and holy hell were they buggy and prone to downtime.
  • For those who said such an implementation has its legitimate use:

    It is stupid. Period.

    Write a simple "onclick" javascript, and the webpage can ping back all external links to its own server for whatever statistics purpose. Using redirect links for statistical purpose is NEVER necessary.

    Also, waiting for those slow servers to reponse and redirect their redirection link is annoying. Just give me the site I am going to anyway please!

    • I have one of these scripts on my web site. It isn't there to track if people click the links. It's to allow me to link to shady web sites without Google knowing that I'm linking to shady web sites and penalizing me for doing so. (They are useful for discussion sometimes.) The script itself is blocked by robots.txt, and so Google never sees that there's a redirect that points to the web site since it never makes a request to the script, whereas simply using a nofollow tag would still allow Google to kno

  • when the world is going to say "enough is enough" with these vermin, and drop them in some sort of Escape From NY type of gulag.

    The world has enough problems facing it without these walking human cancers wreaking financial and technological destruction in their path.

    Oh, I forgot all of our prison spaces are full of people enjoying natural herbs, silly, me, I forgot about such high-priority things like that.

Recursion is the root of computation since it trades description for time.

Working...