From: josh at nicepeople.org (Josh)
Subject: TinyURL

There is something actually interesting about tinyurl's sequence 
predictability:
You can gain an idea of what is in the collective consciousness at any 
given date.

The letters assigned have nothing to do with the url being posted but 
are rather assigned in continuing sequence,  currently we are at t1xx.
One only has to go back a little ways to get an idea of where they are 
currently and look for dates.

The sequence increments in the following manner: 0-9 then A-Z

The value of the predictability has much more value than simply gleaning 
passwords.  While factoring in the fact that not all sites have long 
urls,  one could develop a site ranking using the urls gleaned from 
tinyurl based on where the letter counts are per day.  At a given time 
each day, simply create a tinyurl and use that as the starting point for 
the day's info, with the following day's tinyurl as an endpoint.

Also, it is a neat way to keep up on current events/read on topics you 
hadn't before.

As far as security is concerned, what is the point of a tiny url? To be 
posted to an email, newsgroups, IRC etc... all of which are public 
forums.  Why would you embed personal information in a tinyurl?  I went 
through a sample of about 300 urls and found no uname/pass combos.  The 
only time you will most likely find uname/pass combos in a tinyurl is 
when the poster himself is probably not the holder of the account (i.e. 
Someone posts a url to funny porn).

Tinyurl is a service which is used mainly by the educated/civilized who 
don't want to burden others with a 4 page query string.  Those who know 
about tinyurl most likely are intelligent enough to use it properly.

-Josh
josh@...epeople.org

Joel R. Helgeson wrote:

>This is an information leak rather than a real vulnerability. I thought it
>might be of interest to others...
>
>www.tinyurl.com is a website that will convert a long url to a short one. If
>you want to email a link to say, driving directions on mapquest, the url is
>rather long and will get broken up. Tinyurl will store that long link, and
>give you a short one that looks like: http://tinyurl.com/abcd
>
>It appears that the last four letters are incremented one letter at a time,
>so my URL may be aaaa, then aaab, and so forth.
>If people are using the tiny URL service to pass along URL's to sensitive
>information, it is easy to guess these URL's.
>
>I recently sent an email to someone with a tinyurl, and decided to change
>one character in the url and came across a link to a kiddie porn site...
>http://tinyurl.com/stab
>
>Its a coincidence that stab is a word, but its just a few characters off
>from my URL, staa & stac are also valid URL's.
>
>The TinyURL service should use a randomly created string, rather than one
>that is incremented by one character.  Regardless, users of this service
>could have the information they intend to share with others viewed by anyone
>that types in the string.
>
>Thoughts?
>
>Joel R. Helgeson
>Director of Networking & Security Services
>SymetriQ Corporation
>
>"Give a man fire, and he'll be warm for a day; set a man on fire, and he'll
>be warm for the rest of his life."
>
>_______________________________________________
>Full-Disclosure - We believe in it.
>Charter: http://lists.netsys.com/full-disclosure-charter.html
>
>
>  
>

Powered by blists - more mailing lists