lists.openwall.net   lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  linux-cve-announce  PHC 
Open Source and information security mailing list archives
 
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <GEEDKMHKHEHFHJFANJDCCEOCGNAA.ricky.blaikie@servercity.co.uk>
From: ricky.blaikie at servercity.co.uk (Ricky Blaikie)
Subject: TinyURL

Can we now agree that this is not an ideal medium for passing sensitive
information?

Surely anyone with an iota of common sense would realise that this would not
be a 'good thing(tm)'?

Hence, we veer wildly into the 'mostly irrelevant' category ;-)

Cheer all,
--
Ricky Blaikie - Server City Ltd
TEL: 0871 2601000 : FAX: 0871 2601001 : http://www.servercity.co.uk
Visit our website for latest offers and pricing or e-mail me.

-----Original Message-----
From: full-disclosure-admin@...ts.netsys.com
[mailto:full-disclosure-admin@...ts.netsys.com]On Behalf Of Kenton Smith
Sent: 29 October 2003 17:05
To: Joel R. Helgeson
Cc: full-disclosure@...sys.com
Subject: Re: [Full-Disclosure] TinyURL


I would say if your passing sensitive information you shouldn't use this
service anyway. Even if they randomized it, there's nothing stopping
someone from just randomly entering URL's. I'd stumble upon your
sensitive information eventually. It's fine for passing news stories and
Ebay links, but I wouldn't use it for much else.

Kenton

On Wed, 2003-10-29 at 04:19, Joel R. Helgeson wrote:
> This is an information leak rather than a real vulnerability. I thought it
> might be of interest to others...
>
> www.tinyurl.com is a website that will convert a long url to a short one.
If
> you want to email a link to say, driving directions on mapquest, the url
is
> rather long and will get broken up. Tinyurl will store that long link, and
> give you a short one that looks like: http://tinyurl.com/abcd
>
> It appears that the last four letters are incremented one letter at a
time,
> so my URL may be aaaa, then aaab, and so forth.
> If people are using the tiny URL service to pass along URL's to sensitive
> information, it is easy to guess these URL's.
>
> I recently sent an email to someone with a tinyurl, and decided to change
> one character in the url and came across a link to a kiddie porn site...
> http://tinyurl.com/stab
>
> Its a coincidence that stab is a word, but its just a few characters off
> from my URL, staa & stac are also valid URL's.
>
> The TinyURL service should use a randomly created string, rather than one
> that is incremented by one character.  Regardless, users of this service
> could have the information they intend to share with others viewed by
anyone
> that types in the string.
>
> Thoughts?
>
> Joel R. Helgeson
> Director of Networking & Security Services
> SymetriQ Corporation
>
> "Give a man fire, and he'll be warm for a day; set a man on fire, and
he'll
> be warm for the rest of his life."
>
> _______________________________________________
> Full-Disclosure - We believe in it.
> Charter: http://lists.netsys.com/full-disclosure-charter.html

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html


Powered by blists - more mailing lists

Powered by Openwall GNU/*/Linux Powered by OpenVZ