Recently, I found several legitimate sites, with bad coding practices, used to redirect users to spam sites with the help of URL shorteners. Here is how the scam works:
- The legitimate sites have a warning page for all links to external sites (i.e. http://good.com/redirect?url=http://example.com/)
- The warning page can be used to redirect users to any domain, including spam sites and malicious pages (i.e. http://good.com/redirect?url=http://spam.com/)
- Spammers use a URL shortener like bit.ly to hide the long URL (i.e. http://bit.ly/aaaa redirects to http://good.com/redirect?url=http://spam.com/ which redirects users to http://spam.com/)
Most URL shorteners do some checks on the final URLs to prevent spammers from using their service. By using a legitimate intermediate site, the attackers prevent URL shortening services from checking the true final destination and therefore prevent blacklisting or blocking of the shortened link.fmcsa.dot.gov
One example of such redirection pages is http://www.fmcsa.dot.gov/redirect.asp?page=https://www.zscaler.com/
. Change https://www.zscaler.com/
to any URL. I've seen this page used to redirect to the rogue pharmacy canadapharm.org
The redirection is not done by the standard Meta refresh tag (
meta http-equiv="refresh" content="6;url=https://www.zscaler.com/"
In addition to being used by spammers, fmcsa.dot.gov
|Cross-Site scripting on fmcsa.dot.gov|
Unchecked redirections is yet another security flaw that developers need to keep in mind when developing a website. Having a website widely used for spam will likely get it blacklisted by Google Browsing and other security and spam blacklists, preventing users to access any page on the website unless they dare ignore the scary warning message from their browser.