Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

I accidentally made my link shortener into a malware honeypot

app.y.gy

Post reply on HN
Print view View original

31–40 of 118 posts

Re: I accidentally made my link shortener into a malware honeypot

#31

Post by joshstrange »

TehShrike wrote: post #30
JoshTriplett wrote: post #18

What's the benefit of a link shortener, these days? It made sense back before Twitter had one of their own. And I know that some people use it to get link analytics. I've also occasionally seen it used for printed materials, to get pretty URLs that are easy to hand-type. People also use it for malicious purposes, such as hiding malware, or disguising referral links, or otherwise trying to obfuscate where a link is go…

Sending SMS messages to users/customers

This is a valid use case, my company does this, but I would never outsource it when a link expander isn't difficult to build exactly to the spec you want/need.

Re: I accidentally made my link shortener into a malware honeypot

#32

Post by prophesi »

namrog84 wrote: post #24
JoshTriplett wrote: post #18

What's the benefit of a link shortener, these days? It made sense back before Twitter had one of their own. And I know that some people use it to get link analytics. I've also occasionally seen it used for printed materials, to get pretty URLs that are easy to hand-type. People also use it for malicious purposes, such as hiding malware, or disguising referral links, or otherwise trying to obfuscate where a link is go…

I see most printed things just use qr codes now too. And most phones can go to qr code url pretty easy

Which is most unfortunate... QR/Camera apps usually just show the domain anyways, and QR codes can easily fit large URL's. I imagine shorteners are used just so that they can choose a lower QR version and include a pretty logo in the middle.

Re: I accidentally made my link shortener into a malware honeypot

#33

Post by aiisjustanif »

namrog84 wrote: post #24
JoshTriplett wrote: post #18

What's the benefit of a link shortener, these days? It made sense back before Twitter had one of their own. And I know that some people use it to get link analytics. I've also occasionally seen it used for printed materials, to get pretty URLs that are easy to hand-type. People also use it for malicious purposes, such as hiding malware, or disguising referral links, or otherwise trying to obfuscate where a link is go…

I see most printed things just use qr codes now too. And most phones can go to qr code url pretty easy

Beneficial for shared presentations

Re: I accidentally made my link shortener into a malware honeypot

#34

Post by bombcar »

JoshTriplett wrote: post #18

What's the benefit of a link shortener, these days? It made sense back before Twitter had one of their own. And I know that some people use it to get link analytics. I've also occasionally seen it used for printed materials, to get pretty URLs that are easy to hand-type. People also use it for malicious purposes, such as hiding malware, or disguising referral links, or otherwise trying to obfuscate where a link is go…

For people without direct control of their domains/URLs some of them let you have a short link that you can keep updating to point to the current.

But most public ones don’t let you change the redirect.

Re: I accidentally made my link shortener into a malware honeypot

#35

Post by thimkerbell »

nerdbert wrote: post #26

I made a link shortener in 2010 and it was such a terrible experience. Constant notices from my hosting company about child porn links, repeated ominous emails from the FBI and their counterparts in other countries, having my server temporarily shut down repeatedly. I abandoned it after 6 months because the amount of time it took to continually adapt countermeasures to all the scummy abusers was too overwhelming. In…

How can we grow better people?

Re: I accidentally made my link shortener into a malware honeypot

#36

Post by thimkerbell »

Vt71fcAqt7 wrote: post #9

This is a great writeup. If you are just looking to deter scammers I bet $1 would have the same affect. I don't think scammers are worried about the price as much as having to give any amount of information to you. I could be wrong though as I am not a scammer!

Payment or email&phone also gives the site owner sellable info. Maybe not a good idea for the customer.

Re: I accidentally made my link shortener into a malware honeypot

#37

Post by elaus »

What2159 wrote: post #27
TimLeland wrote: post #17

I can really relate to this article! I created T.LY URL Shortener in 2018, and I've encountered all these issues and more! I found out the hard way when my hosting company shut down my servers for malicious content about a week into launching the site. Malicious actors will go to all sorts of lengths to achieve their goals. Be careful relying on Stripe to prevent these users. Next they will start using stolen credit…

Affordable is not a price. I don't want to login before getting pricing.

This is really one of the worst patterns in the SAAS market.

I don't want to provide my data to multiple services just to be able to compare their prices and find out which one I'm actually gonna use. At first this will lead to countless automated mails from all those "founders" asking why I haven't started paying yet, and if I'm unlucky my credentials end up on haveibeenpwned.com…

Re: I accidentally made my link shortener into a malware honeypot

#38

Post by hoistbypetard »

What2159 wrote: post #27
TimLeland wrote: post #17

I can really relate to this article! I created T.LY URL Shortener in 2018, and I've encountered all these issues and more! I found out the hard way when my hosting company shut down my servers for malicious content about a week into launching the site. Malicious actors will go to all sorts of lengths to achieve their goals. Be careful relying on Stripe to prevent these users. Next they will start using stolen credit…

Affordable is not a price. I don't want to login before getting pricing.

This. And related: I don't want to have to try your system in order to get pricing. I've seen that a couple times, particularly for things that are in beta, where you don't even see pricing until the end of the trial period.

Integrating a new system requires some effort. And there are some systems, like the one in question here, where there's a real cap on how much value they could possibly provide for me, even if they're perfect.

If I can't see whether the pricing falls in that range before I need to sign up, I'm just not going to seriously consider it for most services.

Re: I accidentally made my link shortener into a malware honeypot

#39

Post by optimalsolver »

david422 wrote: post #25

I've dealt with some spammers to various degrees. I think one of the most effective ways of dealing with spammers is to - "shadowban" them. Allow them to use your service, but don't indicate to them that you've identified them as malicious. For instance, when dealing with chat spammers - allow them to chat, but do not show their chats to other users. Another level would be to allow them to chat, but only show their c…

One step away from this:

https://twitter.com/nearcyan/status/1532076277947330561

Re: I accidentally made my link shortener into a malware honeypot

#40

Post by xyst »

david422 wrote: post #25

I've dealt with some spammers to various degrees. I think one of the most effective ways of dealing with spammers is to - "shadowban" them. Allow them to use your service, but don't indicate to them that you've identified them as malicious. For instance, when dealing with chat spammers - allow them to chat, but do not show their chats to other users. Another level would be to allow them to chat, but only show their c…

> if the ip address that created the link shortener accesses the link, they get the real redirect, and if a different ip address accesses it

If there’s anything I have learned about IP based blocking, it’s very unreliable. Especially in a NAT’d world.

Great you “shadowbanned” an IP, but you also impacted many other people and devices behind that public IP including the bad actor.

IPv6 is supposed to make NAT irrelevant but adoption is still very low despite IPv4 deprecated more than 2 decades ago.

Post reply on HN