Short URLs Considered Harmful for Cloud Services
Vitaly Shmatikov (via Bruce Schneier):
Short URLs produced by bit.ly, goo.gl, and similar services are so short that they can be scanned by brute force. Our scan discovered a large number of Microsoft OneDrive accounts with private documents. Many of these accounts are unlocked and allow anyone to inject malware that will be automatically downloaded to users’ devices. We also discovered many driving directions that reveal sensitive information for identifiable individuals, including their visits to specialized medical facilities, prisons, and adult establishments.
At any rate, the owners of the services in question quickly modified their code so that short links couldn’t be brute-forced or automatically crawled, and measures were put in place to limit access rates on any particular link.
This stuff was solved years ago on services built by a single developer. This shouldn’t be an issue at large companies like Google and Microsoft.
2 Comments RSS · Twitter
"This stuff was solved years ago on services built by a single developer"
I think this is a perfect example of diffusion of responsibility. If you're alone, you *know* it's your job to make stuff secure.
"Trying to mitigate access to a document by using an obscure but completely unprotected URL is foolish at best"
I don't know if this is necessarily true in all cases. I mean, almost any protected URL is only protected by its address and some obscure post parameters. True, post parameters are better than just the URL, but not by that much.
Trying to mitigate access to a document by using an obscure but completely unprotected URL is foolish at best, whether or not a third-party redirector is involved.
(The use of a third-party redirector is, in itself, an additional foolish idea.)