Unvalidated Redirect in Google (or How Google Sent Me To Bing)

http://blog.tinfoilsecurity.com/its-the-little-things-that-matter-or-how-goog

by borski • 14 years ago

66 23 14 years ago

blog.tinfoilsecurity.com

e1ven• 14 years ago

One thing that's fun is that Google has a page detailing how to handle redirects on your own sites- http://googlewebmastercentral.blogspot.com/2009/01/open-redi...

dhruvbird• 14 years ago

hypocrisy??

davidu• 14 years ago

On the flip side, when Google does find a malicious URL being used in their redirector they are able to disable the URL and make the link invalid.

They might not do this today, but Bitly now does, and so there's that.

Firehed• 14 years ago

Should be fun to see what happens when you get them to automatically blacklist their own sites... ;)

arscan• 14 years ago

I wonder if submitting the following link to HN would result in (google.com) being displayed next to the link instead of (tinfoilsecurity.com):

http://www.google.com/finance/url?sa=D&q=http://blog.tin...

I'd try, but I don't want to risk upsetting HN's moderators ;-)

borski5• 14 years ago

Ha, that's cute. I wonder if HN follows redirects in link-posting. My suspicion is no - you can post a 404, for example, and it'll just use the domain.

rwos• 14 years ago

1.) Yes, I think so. 2.) Don't worry, it has been done before:

http://news.ycombinator.com/item?id=1259695

(That particular instance doesn't work anymore, though)

stusmall• 14 years ago

Also, if you want to hide the URL in the link better, just pad the end of the query string with garbage and they won't even notice it:

http://www.google.com/finance/url?sa=D&q=http://goo.gl/j...

g_lined• 14 years ago

Or embed it with the government redirect mentioned. "Here's what Obama had to say about Google on yesterday's visit to Vermont!" http://labor.vermont.gov/LinkClick.aspx?link=http://www.goog...

borski5• 14 years ago

Linkception. You can take that link and throw it in Google, and so on... At some point, maybe you'll hit a limit? Sounds like a fun test to run... ;)

subway• 14 years ago

You could, of course, also use the hex representation of the ascii url to obscure it: http://www.google.com/finance/url?sa=D&q=%68%74%74%70%3a...

cominatchu• 14 years ago

We check for these types of vulnerabilities, and it's free to sign up: https://armorhub.com

borski5• 14 years ago

We found this by using the Tinfoil Security scanner, and it's free to sign up with us too - we check for this and quite a bit more. :)

ghayes• 14 years ago

On a blog post for Tinfoil Security, it would be better to phrase this as "We also check for these types of vulnerabilities." Tinfoil Security clearly found this specific vulnerability using their own product.

darkarmani2• 14 years ago

That would make sense if he left the comment on Tinfoil's actual blog post. Here in HN i don't think it matters.

StevenXC3• 14 years ago

I couldn't get bit.ly to replicate the behavior that the article claimed: shortening .gov URLs using 1.usa.gov. Anyone else have any luck?

borski5• 14 years ago

Try shortening http://whitehouse.gov -> http://1.usa.gov/15DR7

StevenXC3• 14 years ago

Interesting. http://labor.vermont.gov was shortened with the bit.ly domain - perhaps they caught on to the redirect.

darkarmani2• 14 years ago

This is a good way to get around domain reputation ratings like SiteAdvisor. A domain like google isn't going to get hurt by a reputation service, but a small domain would get marked red after a few redirects to exploits or malware get crawled.

Unvalidated Redirect in Google (or How Google Sent Me To Bing)

Related Stories