Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

I accidentally made my link shortener into a malware honeypot

app.y.gy

Post reply on HN
Print view View original

11–20 of 118 posts

Re: I accidentally made my link shortener into a malware honeypot

#11

Post by kornhole »

I generally always run any shortened link through a link checker before opening. So they are an inconvenience to me.

The time it took you to write all this evidences the problem with hosting the service publicly.

Yesterday I ran into problem with sharing a link to a simplex.chat group which was so long my website builder translated it incorrectly. I looked at link shorteners publicly available and now understand from your writeup why they are somewhat limited now. I found it easier to just spin up my own link shortener on my webserver using Shuri. It took less than a minute for me install. I won't publicize its availability now that I have read this.

Re: I accidentally made my link shortener into a malware honeypot

#12

Post by ay »

Very cool read!

For the malicious links, did you have a chance to track whether the malware actors verify that their links do not work, e.g. by setting a cookie when they make a link and checking it later ?

I wonder if making these malicious links silently work only for the people that submitted them (and to say “no such link” for everyone else) ought to create a degree of confusion and slow them down to some extent at least…

Re: I accidentally made my link shortener into a malware honeypot

#14

Post by sodality2 »

dividendpayee wrote: post #5
hilux wrote: post #3

Such an interesting read. I prompts me to wonder whether abuse was one reason that Heroku removed their beloved (among students) free tier.

I was shocked that even with the free tier gone, there's still some level of abuse. Even the paywall doesn't totally cure the problem.

Passing malicious URL filters is crucial to operations like ransomware, phishing, etc - hiding a bad domain behind a good one is extremely valuable to hackers and relatively cheap. Though I am surprised they'd pay for it due to the payment -> identity link (maybe it's stolen CCs but Stripe is pretty good about blocking that).

Re: I accidentally made my link shortener into a malware honeypot

#15

Post by nubinetwork »

Vt71fcAqt7 wrote: post #9

This is a great writeup. If you are just looking to deter scammers I bet $1 would have the same affect. I don't think scammers are worried about the price as much as having to give any amount of information to you. I could be wrong though as I am not a scammer!

The article said that a few scammers tried to pay them to look more legitimate.

Re: I accidentally made my link shortener into a malware honeypot

#16

Post by doakes »

kornhole wrote: post #11

I generally always run any shortened link through a link checker before opening. So they are an inconvenience to me. The time it took you to write all this evidences the problem with hosting the service publicly. Yesterday I ran into problem with sharing a link to a simplex.chat group which was so long my website builder translated it incorrectly. I looked at link shorteners publicly available and now understand from…

Which link checker(s) do you use?

Re: I accidentally made my link shortener into a malware honeypot

#17

Post by TimLeland »

I can really relate to this article! I created T.LY URL Shortener in 2018, and I've encountered all these issues and more! I found out the hard way when my hosting company shut down my servers for malicious content about a week into launching the site. Malicious actors will go to all sorts of lengths to achieve their goals.

Be careful relying on Stripe to prevent these users. Next they will start using stolen credit cards to create accounts then you will face disputes. If you get too many, Stripe will prevent you from processing payments.

About a year ago, I launched a service called Link Shield. It's an API that returns risk scores (0-100) on URLs. It uses AI and other services to score if a URL is malicious. Check it out and let me know if you would be interested in trying it linkshieldapi.com/

Re: I accidentally made my link shortener into a malware honeypot

#18

Post by JoshTriplett »

What's the benefit of a link shortener, these days?

It made sense back before Twitter had one of their own. And I know that some people use it to get link analytics. I've also occasionally seen it used for printed materials, to get pretty URLs that are easy to hand-type.

People also use it for malicious purposes, such as hiding malware, or disguising referral links, or otherwise trying to obfuscate where a link is going. (Note: I'm not calling referral links malicious, I'm calling disguised referral links malicious.)

Other than printed materials (which need pretty URLs and thus often need a dedicated first-party URL shortener) and analytics, what are people using third-party URL shorteners for today?

Re: I accidentally made my link shortener into a malware honeypot

#19

Post by donatj »

JoshTriplett wrote: post #18

What's the benefit of a link shortener, these days? It made sense back before Twitter had one of their own. And I know that some people use it to get link analytics. I've also occasionally seen it used for printed materials, to get pretty URLs that are easy to hand-type. People also use it for malicious purposes, such as hiding malware, or disguising referral links, or otherwise trying to obfuscate where a link is go…

My company has one they use to track who clicks on links in emails.

Re: I accidentally made my link shortener into a malware honeypot

#20

Post by dhosek »

VyseofArcadia wrote: post #8

Is there a name for this phenomenon? It's sort of like the dark forest, but not exactly. As soon as a free service becomes discovered, it is immediately swamped by scammers and spammers. Many many years ago I ran a small forum for a small webcomic, and one day it was just full of low effort scams and spam. For an audience of, I dunno, a dozen people? I just shut the whole thing down because it wasn't worth our time t…

I had a similar thing happen with a mediawiki site that I run. There was some “shrinkwrap” software behind the abuse, though, and a trivial capcha on account creation was sufficient to turn the abuse from a flood into a manageable trickle (I haven’t had to deal with spam since December, and when I do get spamming, it’s typically happening no more than once a month).
Post reply on HN