RE: TinyURL

["David Klotz" <klotz () acm org>]

I don't agree.  First, you shouldn't be using a service like this to send
sensitive information in the first place, and if you are, you get what you
deserve.  If I leave my bank account number in my mailbox so I'll know where
to get it, I shouldn't blame the post office if someone comes along and
steals it.

Second, the whole idea behind tinyurl is to take long, difficult to type
URLs and change them into something much easier.  In order for them to
generate a string that was long enough so that the chance of someone
randomly guessing another valid string is low, they would have to use a
string so long that it would only be marginally easier to type or send than
the original URL it was designed to replace...

Just my 2 cents...

-dk




> -----Original Message-----
> From: full-disclosure-admin () lists netsys com 
> [mailto:full-disclosure-admin () lists netsys com] On Behalf Of 
> Joel R. Helgeson
> Sent: Wednesday, October 29, 2003 5:19 AM
> To: full-disclosure () netsys com
> Subject: [Full-disclosure] TinyURL
>
>
> This is an information leak rather than a real vulnerability. 
> I thought it might be of interest to others...
www.tinyurl.com is a website that will convert a long url to a short one. If
you want to email a link to say, driving directions on mapquest, the url is
rather long and will get broken up. Tinyurl will store that long link, and
give you a short one that looks like: http://tinyurl.com/abcd

It appears that the last four letters are incremented one letter at a time,
so my URL may be aaaa, then aaab, and so forth. If people are using the tiny
URL service to pass along URL's to sensitive information, it is easy to
guess these URL's.

I recently sent an email to someone with a tinyurl, and decided to change
one character in the url and came across a link to a kiddie porn site...
http://tinyurl.com/stab

Its a coincidence that stab is a word, but its just a few characters off
from my URL, staa & stac are also valid URL's.

The TinyURL service should use a randomly created string, rather than one
that is incremented by one character.  Regardless, users of this service
could have the information they intend to share with others viewed by anyone
that types in the string.

Thoughts?

Joel R. Helgeson
Director of Networking & Security Services
SymetriQ Corporation

"Give a man fire, and he'll be warm for a day; set a man on fire, and he'll
be warm for the rest of his life."

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html