Hacked URL service puts users at risk

By

Two million Cligs URLs redirected in weekend attack.

Surfers are being warned not to click on shortened URLs on sites such as Twitter, after it emerged that a major URL shortening service was hacked at the weekend.

Services provided by firms such as TinyURL, Bit.ly and Cligs have become increasingly popular, as they allow URLs to be displayed in a more succinct form.

However, Cligs, which is seen as the fourth most popular shortening service, suffered a hacking incident in which more than two million URLs were apparently changed to a single URL, directing users to a story about Twitter hashtags by blogger Kevin Sablan of the Orange County Register.

The firm said in a posting on the Cligs blog that a "security hole in the Cligs editing functionality" was to blame for the attack, which came from an IP address in Canada.

"Most important thing: your passwords are safe. They are stored encrypted and were never at risk in this attack," said the firm.

However, Graham Cluley, senior technology consultant at Sophos, warned that the incident could have been much worse.

"It is not yet apparent what the hackers' intentions were, but they could just as easily have redirected millions of shortened URLs to a website hosting malware," he wrote in a blog post.

"That is one of the reasons why it can be helpful to run a plug-in that will expand shortened URLs before you click on them."

Roel Schouwenberg, senior anti-virus researcher at Kaspersky Lab, said that such services will be an attractive target for hackers as it gives them access to numerous URLs.

"I abandoned the URL shortening services on all of the social networks I'm on some time ago," he said. "If you strip out the http:// portion, such sites will no longer convert them into shortened URLs automatically. It's certainly less convenient, but at least the reader knows where I'm pointing to."

Hacked URL service puts users at risk
Got a news tip for our journalists? Share it with us anonymously here.
Copyright ©v3.co.uk
Tags:

Most Read Articles

ADHA readies market test of Accenture's $788m My Health Record deal

ADHA readies market test of Accenture's $788m My Health Record deal

Western Sydney University establishes dedicated data function

Western Sydney University establishes dedicated data function

DeepSeek faces ban from Apple, Google app stores in Germany

DeepSeek faces ban from Apple, Google app stores in Germany

SA Water plans 'once-in-a-generation' core technology uplift

SA Water plans 'once-in-a-generation' core technology uplift

Log In

  |  Forgot your password?