Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

This link says it's from YouTube but it's not

youtube.com

Post reply on HN
Print view View original

31–40 of 60 posts

Re: This link says it's from YouTube but it's not

#31

Post by kleevr »

My first computer job as a teen was working at a small SEO shop (3 people) writing little cgi/perl scripts for this and that.

Yahoo's http server at that time used to take redirect URLs in this format: "http://yahoo/url/*http://exiturl/. They were using these URLs on all search results, I'm guessing to track click-throughs to improve rankings. So I set up a script on our site to load an image using this format with the img src in the exit-url, and for the yahoo-url and we would round robin 'client' links though. Essentially spoofing legitimate search&clicks on yahoo from unique IPs from our site visitors. Over the next two weeks all our sites started bubbling up in the results. This worked for about a month before Yahoo changed something (I'd guess they started validating the http-referrer or the exit-url), and it all stopped working.

But, for that brief window of time when it was working, I was the king of the high fives.

(FWIW, I don't do SEO work of any kind anymore, and I certainly don't advocate 'blackhat seo'.)

Re: This link says it's from YouTube but it's not

#32

Post by ominous_prime »

lanaer wrote: post #19
pchristensen wrote: post #4

Wow, I don't like this. My usual tactic of looking for the / after the .tld isn't a general solution anymore. I hope my bank doesn't implement this functionality.

So it is important to also check the URL in your address bar _after_ you click, as well. This trick won’t be able to fake that.

But would you always catch it if you were redirected to www.youtube.com.you1ube.com/something?

Or possibly worse - http://www.youtube.com⁄bad-site.com/something_else

Re: This link says it's from YouTube but it's not

#33

Post by jrockway »

URLs are not a security mechanism. They are a non-canonical resource locator, where each part is resolved by a different server. It's a way to write a "program" that does a DNS lookup and HTTP query in a simple way.

Nothing more, nothing less.

If you want security, start a CA, give each site you like its own SSL cert (signed by you), and enjoy.

Re: This link says it's from YouTube but it's not

#34

Post by frossie »

mrcharles wrote: post #9

I don't know a single non-technical but non-internet-ignorant user who wouldn't be suckered in by this. I've taught people how to scan for valid links, and now they can't even trust that.

How do you tell civilians to scan for valid links? I say "if you see another domain name/IP address in the URL, don't do it". Maybe that is over-broad, but it works.

Re: This link says it's from YouTube but it's not

#35

Post by IgorPartola »

chacha102 wrote: post #11
Phantom wrote: post #6

Earlier quoted context omitted.

correct! Basic idea is to show how easy it is to use this simple redirect against users of social media sites. Most people on HN would have seen this link and trusted it to be from YouTube.

Furthermore, I can see browsers detecting this type of behavior and prompting the user about it. If a browser sees an encoded URL in the query string, and then gets a location header to go to that URL, and that URL is not on the same domain, it would prompt the user that you are leaving that domain. I can't see many sites that are legitimate, and use redirection techniques that meet all of my criteria.

http://voice.google.com/ redirects to http://google.com/voice. Technically different domains, but I would be really annoyed if I had to confirm this every time. I suppose you could add a white list, but now we are just annoying people when they first start using a particular install of a browser.

Re: This link says it's from YouTube but it's not

#36

Post by code_duck »

xtacy wrote: post #20
tednaleid wrote: post #15

This is a common exploit. So common that it's #8 on the 2010 OWASP top 10 most critical web application security risks: "Unvalidated Redirects and Forwards". http://www.owasp.org/index.php/Category:OWASP_Top_Ten_Projec... Every web app developer should review these vulnerabilities before releasing their code to the world.

Interesting. Facebook had a similar exploit earlier but they seem to have solved it easily by attaching a hash to the redirect: site.com/redirect?l= &h=hash(secret,url)

Aha, that's a good idea.

We have an open redirect on our site that I've been looking at fixing, but while verifying all the possible links against a whitelist would work, it would be a pain.

Re: This link says it's from YouTube but it's not

#37

Post by Vivtek »

dotBen wrote: post #27

This is hardly new, but I agree it is an issue. The answer to this security issue is either: 1) The bit.ly route - store off-site urls your organization wants to link to as a value and give the user an url with just the key in it. 2) Create a secret salted hash of the url and include that with the url in the args. Upon request, the receiver would re-hash the url and compare it to the hash given. Unless someone revers…

If you're going to that much trouble, perhaps you could set up permissions to add target URLs?

Re: This link says it's from YouTube but it's not

#39

Post by njharman »

frossie wrote: post #34
mrcharles wrote: post #9

I don't know a single non-technical but non-internet-ignorant user who wouldn't be suckered in by this. I've taught people how to scan for valid links, and now they can't even trust that.

How do you tell civilians to scan for valid links? I say "if you see another domain name/IP address in the URL, don't do it". Maybe that is over-broad, but it works.

> domain name/IP address in the URL

civilian what's a domain? Is that like a mailing address? the Uwhat? Stop being so technical!

Re: This link says it's from YouTube but it's not

#40

Post by lanaer »

ominous_prime wrote: post #32
lanaer wrote: post #19

Earlier quoted context omitted.

So it is important to also check the URL in your address bar _after_ you click, as well. This trick won’t be able to fake that.

But would you always catch it if you were redirected to www.youtube.com.you1ube.com/something? Or possibly worse - http://www.youtube.com⁄bad-site.com/something_else

In this I rely on my browser to filter deceptive characters in domain names.

When I hover over the link you gave (or click it and see it in the address bar), it looks like http://www.youtube.xn--combad-site-hx3f.com/something_else (which lets off plenty of flags for me).

Post reply on HN