When even .gov sites lead you down the wrong path
Connecting state and local government leaders
The recent exploit of open redirect in some shortened .gov Web addresses underscores the importance of server configuration to guard against easily prevented problems.
An old trick made some new news in the past week as spammers took advantage of a URL shortening service for .gov websites to redirect Web traffic to malicious sites.
“This type of tactic is nothing new,” said Eric Park, a senior analyst at Symantec who reported on the exploits. “It’s a little unfortunate in this case because of the .gov thing. People tend to think they can trust it.”
In fact, trust is exactly what USA.gov is promoting in its collaboration with Bitly.com, a service that allows users to create shortened URLs that are convenient to share. “Now, whenever anyone uses Bitly to shorten a URL that ends in .gov or .mil, they will receive a short, trustworthy 1.USA.gov URL in return,” the General Services Administration says on its HowTo.gov website.
The violation of that trust in these attacks underscores the importance of server configuration in guarding against easily prevented problems.
The URL shortening service for government domains is called 1.USA.gov, and it works by simply putting a .gov URL into the Bitly Web page and clicking “shorten” to produce a new, short URL with the 1.USA.gov domain. But the shortened URL will not show where a request might be redirected to.
“This is not a security issue at Bitly or with our short URLs,” said Hilary Mason, chief scientist at Bitly. “It’s an issue with government websites using open redirect that allows the government site to redirect to a spam website.”
It is not a problem specific to 1.USA.gov, but to any site that allows open redirection, in which a URL is modified to take a user to a site other than the one it might look like they’re going to. For example, the link http://www.baltimorecity.gov goes to the home page for the City of Baltimore, but the link http://www.baltimorecity.gov/LinkClick.aspx?link=http://google.com when shortened will look like a standard baltimorecity.gov link, but will actually redirect to google.com.
“Spammers have noticed that certain .gov URLs have open redirect enabled” and took advantage of it to deliver traffic to malicious sites, Symantec’s Park said.
All of which raises the question, why enable open redirect at all? Most government sites probably don’t, Park said. “I don’t think there is a legitimate business need today for it.”
He admitted that he might be biased on this subject. “I’m an anti-spam guy,” he said. But he is not alone. The Open Web Application Security Project describes open redirect as a vulnerability that should be eliminated by requiring validation that a redirected target server has a relation to the original target server before allowing redirection to occur.
The good news in this is that Bitly and GSA both took action when the problem was discovered.
“We moved very quickly to block these redirections,” Mason said. She said Bitly takes such issues seriously and notified partners at USA.gov about the problem.
A GSA spokesman said the agency has removed the affected domains and is working with government Web managers to help with removing the vulnerability.
The response apparently has worked. The 1.USA.gov service publishes metrics about the number of redirected visits, and Park said that as of Oct. 23 there had been just short of 59,000 total redirects to spam sites. But the daily number has been dropping sharply -- since the initial publication of the problem on Oct. 17, the number of redirected clicks had dropped from about 15,000 on Oct. 19 to just a handful on each of the next three days.
GSA says it is turning the recent incident into a learning situation. “This has allowed us to learn of some vulnerabilities on some government websites and will help us find more in the future,” the agency said in a statement.
Let’s hope that administrators and managers take advantage of this lesson and make sure they know what servers are on their systems and understand how they are configured.
NEXT STORY: Obama, Romney give lip service to cybersecurity