The Privacy and Security Risks of Shortened URLs

Shortened URLs, also known as short links, have become quite popular in recent years as a way to shorten very long web addresses and make them easier to share on social media or in text messages. However, while short links offer convenience, they also pose some important privacy and security risks that users should be aware of. The rise of social media and services that impose character limits has made shortened URLs become commonplace on the internet.

How Shortened URLs Work

When a user clicks on a shortened link, the URL directs them to a URL shortening service first before sending them to the intended destination. This temporary redirect allows the shortening service to gather analytics on who is clicking the link and from where. While this type of tracking is usually harmless for marketing purposes, it does mean that personal data about users’ online activities is being collected and stored by a third party. For example, a long website address like https://partnerstack.tresorit.com/iguxcmbcwtpw-fliji could become something simple like https://go.frankline.tech/tresorit

Some key things to note about how shortened URLs operate:

• URL shorteners strip out tracking codes embedded in long URLs to make them aesthetically shorter for sharing. However, this tracking data is still collected by the shortening service.
• The redirection process occurs too quickly for users to see where they are actually being sent, obscuring the final destination site.
• Shortened links can be dynamically changed by those who generated them to redirect users to different locations over time.
• Advanced shortening services may also allow the tracking of user behavior even after they reach the destination site, through man-in-the-middle style attacks.

Common Threats Posed by Shortened URLs

Beyond the analytics gathered during typical link sharing, shortened URLs raise several privacy and security risks:

Disguised Malware and Phishing Attempts

One of the biggest security risks is users unknowingly being redirected to malicious sites hosting exploits, phishing pages, or malware payloads. Shortened URLs obscure the true destination, meaning security scanning and domain reputation checks cannot be reliably performed ahead of clicking. Once on the malicious site, zero-day exploits or credential/personal data theft can instantly occur.

Personalized shortened links sent over email/messaging can be used to phish users by pre-filling stolen login data into copied website templates. Public shortened links posted for legitimate purposes could be later altered by attackers to point to malware downloads or phishing pages instead.

Loss of Transparency

One downside of shortened URLs is the loss of transparency about the final destination. When a link is shortened, there is no clear indication of exactly where users will be taken simply by looking at or hovering over the short link. This means malicious actors could potentially disguise phishing sites or malware downloads behind shortened links in order to trick users.

Even if short links were created with good intentions initially, there is a risk the original long URL could later be changed by the publisher to point somewhere unsafe without the user’s knowledge since the short link itself does not clearly reveal the target. Shortening services don’t have complete control over where the original URLs may eventually redirect.

Privacy and Tracking Concerns

Another issue is that shortening services act as intermediaries that can observe and track users’ browsing behavior. When a short link is clicked, the user’s request first goes through the shortening service’s servers before being redirected to the final site. This allows the shortening service to potentially log details like the user’s IP address, location, device info, and other metadata with each link click.

Some services even inject tracking codes into shortened links in order to gather analytics on how many clicks and shares each link receives. While this data collection may be used for innocuous purposes like stats, the lack of transparency means users typically are not informed about what exactly is being tracked or how their data may be used or shared with other parties.

Potential for Malware Distribution

There are also cybersecurity risks due to the opportunity shortened links provide for social engineering and malware distribution. Link shortening makes it easy to disguise the true nature of a URL, so cybercriminals have used this tactic to distribute phishing pages, scams, and even drive-by downloads of malware through shortened links posted on social media, forums, and messaging services.

If a shortened link is clicked expecting one site but actually leads elsewhere maliciously, the user could unwillingly download viruses or have personal information stolen. Security researchers have found botnets leveraging URL shorteners in large spam campaigns designed to infect as many victims as possible through shortened phishing links.

Malicious Redirects

Even if a shortened link was initially created with good intentions, there is a risk of it later being altered by a bad actor to redirect users elsewhere. This is because shortening services don’t have full control over where the original long URLs ultimately point after being shortened. Cybercriminals have been known to hijack short links by changing the destination URL they map to in order to infect visitors with malware.

So a short link a user accessed safely yesterday could potentially deliver an infected page today without their knowledge since the shortened alias itself provides no clue about the redirected target. Link hijacking means legitimate shortened links can be repurposed for malicious ends without the publisher’s consent or visibility into the change.

Large-Scale Campaigns Continue Unhindered

Shortened links also allow threat actors to dynamically “shim” the redirection path, modifying where traffic is sent on the fly. This is problematic for large-scale phishing or malware distribution campaigns. Even if the initial destination site is taken offline, attackers can seamlessly redirect users to newCommand -infrastructure without needing to resend links at scale. Campaigns can continue open-ended in this manner. Advanced services may intercept and steal sensitive transmitted data like passwords or messages through man-in-the-middle style attacks during the redirection process.

Best Practices for Safely Using Shortened URLs

To mitigate risks as much as possible while still enjoying the brevity of shortened links, here are some tips recommended by security experts:

1. Be wary of shortened links received from unknown sources, and links received over personal communication channels like messaging/email, and avoid clicking them at all if possible. If possible, open them in a sandboxed environment. Using Kasm Workspaces is the quickest and easiest method and the one I use often.
2. Carefully check the domain name being redirected to and watch for mismatches or look-alikes from the short link. Hover over links for pop-ups revealing the target URL.
3. Preview shortened links using online checking services that resolve where users will actually be directed before clicking through. Try expanding shortened links first using an online expander or pasting them into your browser bar before clicking them directly.
4. Avoid using shortened links for highly sensitive pages like login portals, financial sites, etc. to reduce risks of redirects to lookalike phishing pages.
5. Check shortened links were created by reputable services and not free shorteners which may have looser policies or less secure practices.
6. Disable link redirection/expansions where possible to avoid the extra delay and potential for malware downloads during the 302 redirect hop.
7. Consider using URL shortening only within private/trusted circles where the risk of exploitation is reduced rather than with open sharing.
8. Use ad blocking and the latest security software with anti-phishing/malware protection when browsing or clicking shortened links from unknown sources.
9. Consider privacy-focused URL shorteners that avoid major third-party trackers and provide transparency about data policies and practices. If possible, consider hosting one for yourself if you are a business that utilizes short links.
10. Have a trusted security solution like an XDR or a trusted antivirus for online protection. Features like anti-phishing, firewalls, and private browsing can help filter malicious redirections transparently.
11. Consider avoiding URL shorteners altogether unless you understand the privacy implications and trust the service provider not to abuse access or change destinations maliciously later.
12. When sharing shortened links publicly, monitor them on a regular basis and change the destination immediately if the generating party loses control or integrity of the short link.
13. Educate others about these risks so sharing of personal data or compromised financial details via shortened links can be avoided as much as possible.

Being proactive about short-link safety can help balance the utility against potential downsides. With some common sense practices, users can continue to enjoy the sharing benefits of shortened URLs while better-mitigating privacy and security threat vectors. Overall vigilance is still advisable when dealing with truncated links from unverified sources.

While shortened URLs may seem practical, it’s always best to understand the full risks before handing over personal data or installing unknown files and software. With cautious behavior and the right security precautions, users can stay protected even when encountering shortened links online.