NewsApril 18, 2016 @ 4:05 PM

Cloud Complications: Short URLs Come With Big Problems

Human memory is a finite system. George A. Miller’s 1956 work “The Magical Number Seven, Plus or Minus Two: Some Limits on our Capacity for Processing Information argued that the average individual can hold just seven digits in his or her immediate memory at any given time.

It’s no surprise, then, that short URLs have become a common way to solve the problem of massive Web addresses, simplifying the process of recall and access. According to Threatpost, however, new research suggested that the ease of shorter URLs may be long on problems when it comes to cloud storage and collaboration.

The Big Deal With Short URLs

In their new paper “Gone in Six Characters: Short URLs Considered Harmful for Cloud Services,” Vitaly Shmatikov of Cornell Tech and independent researcher Martin Georgiev take aim at cloud services that integrate URL shorteners such as Microsoft OneDrive and Google Maps.

As noted in their work, there’s no absolute limit to the number of characters present in a URL, meaning they can quickly grow beyond the scope of human memory; even writing them down easily introduces errors if a single digit is missed or replaced. Short URLs emerged as a way to cut down on Web clutter and enhance the user experience. Initially, concerns were raised over destination: What if supposedly safe URLs actually led to malicious websites?

Now, two new threats have emerged: storage and collaboration. Shmatikov and Georgiev found that short URLs using just five- or seven-character tokens made it possible for attackers to scan the entire set of shortened addresses governed by the same ruleset.

In OneDrive’s case, that ruleset was predictable, allowing the researchers to resolve 42 percent of shortened URLs and access almost 20,000 OneDrive folders, many with write permissions. Thus, anything supposedly obfuscated by a smaller URL and kept private is nevertheless public domain for anyone willing to do a little brute-force work.

The team also found that shortened Google Maps URLs often resolved to very specific driving directions, meaning physical addresses or even identities could be compromised.

More worrisome than storage is collaboration since, in corporate environments, cloud-shared files are often pushed to user devices on a regular basis to ensure everyone is on the same page. If cybercriminals managed to slip malware into a write-enabled storage drive, they could effectively compromise an entire network.

Large-Scale Adoption

URL shortening has quickly become the norm rather than the exception. TechCrunch noted that Facebook has created its own shortener, which is now being used in conjunction with Messenger to streamline social communication — and it isn’t something businesses can opt out of when using the service.

For its part, Google responded by bumping up its Maps token length after being contacted by Shmatikov and Georgiev, in addition to making it more difficult to scan URLs. Microsoft, meanwhile, denied that the findings constituted a security risk and cut off communication. However, last month the company removed automatic URL shortening from OneDrive.

Bottom line? Shorter is better for people — but some of these people are cybercriminals. For the moment, short URLs are a toss-up between convenience and risk; going too small in the cloud can lead to big problems on the ground.

Share this Article:
Douglas Bonderud

Freelance Writer

A freelance writer for three years, Doug Bonderud is a Western Canadian with expertise in the fields of technology and innovation. In addition to working for the IBM Midsize Insider, The Content Standard and Proteomics programs for Skyword, Doug also writes for companies like Ephricon Web Marketing and sites such as MSDynamicsWorld. Clients are impressed with not only his command of language but the minimal need for editing necessary in his pieces. His ability to create readable, relatable articles from diverse Web content is second to none. He has also written a weekly column for TORWars, a videogaming website; posts about invention and design for and general knowledge articles for WiseGeek. From 2010-2012, Doug did copywriting for Doug is currently a municipal police officer, on track to become a fantasy/sci-fi author.