RE: [Full-Disclosure] TinyURL

From: Steffen Kluge (kluge_at_fujitsu.com.au)
Date: 10/31/03

  • Next message: Jürgen R. Plasser: "[Full-Disclosure] IEpatch.exe?" 
    To: full-disclosure@lists.netsys.com
Date: Fri, 31 Oct 2003 18:16:52 +1100

    Ahh well, who would not remember the famous "unbreakable" DBMS...

    Their QA department is recruiting again: http://tinyurl.com/dork

    Cheers
    Steffen.

    On Thu, 2003-10-30 at 02:11, Bassett, Mark wrote:
    > Anyone want an Asus Motherboard from newegg? :)
    >
    > http://www.tinyurl/boob
    >
    >
    > Mark Bassett
    > Network Administrator
    > World media company
    > Omaha.com
    > 402-898-2079
    >
    >
    > -----Original Message-----
    > From: Joel R. Helgeson [mailto:joel@helgeson.com]
    > Sent: Wednesday, October 29, 2003 5:19 AM
    > To: full-disclosure@netsys.com
    > Subject: [Full-Disclosure] TinyURL
    >
    > This is an information leak rather than a real vulnerability. I thought
    > it
    > might be of interest to others...
    >
    > www.tinyurl.com is a website that will convert a long url to a short
    > one. If
    > you want to email a link to say, driving directions on mapquest, the url
    > is
    > rather long and will get broken up. Tinyurl will store that long link,
    > and
    > give you a short one that looks like: http://tinyurl.com/abcd
    >
    > It appears that the last four letters are incremented one letter at a
    > time,
    > so my URL may be aaaa, then aaab, and so forth.
    > If people are using the tiny URL service to pass along URL's to
    > sensitive
    > information, it is easy to guess these URL's.
    >
    > I recently sent an email to someone with a tinyurl, and decided to
    > change
    > one character in the url and came across a link to a kiddie porn site...
    > http://tinyurl.com/stab
    >
    > Its a coincidence that stab is a word, but its just a few characters off
    > from my URL, staa & stac are also valid URL's.
    >
    > The TinyURL service should use a randomly created string, rather than
    > one
    > that is incremented by one character. Regardless, users of this service
    > could have the information they intend to share with others viewed by
    > anyone
    > that types in the string.
    >
    > Thoughts?
    >
    > Joel R. Helgeson
    > Director of Networking & Security Services
    > SymetriQ Corporation
    >
    > "Give a man fire, and he'll be warm for a day; set a man on fire, and
    > he'll
    > be warm for the rest of his life."
    >
    > _______________________________________________
    > Full-Disclosure - We believe in it.
    > Charter: http://lists.netsys.com/full-disclosure-charter.html
    >
    > _______________________________________________
    > Full-Disclosure - We believe in it.
    > Charter: http://lists.netsys.com/full-disclosure-charter.html

    _______________________________________________
    Full-Disclosure - We believe in it.
    Charter: http://lists.netsys.com/full-disclosure-charter.html

  • Next message: Jürgen R. Plasser: "[Full-Disclosure] IEpatch.exe?"

    Relevant Pages

    • Re: Portable and ok?
      ... you can easily construct constant expressions ... Character and string literals are a bit more difficult. ... You can do the same thing for letters by checking ...
      (comp.lang.c)
    • Re: [Full-Disclosure] TinyURL
      ... Tinyurl will store that long link, ... > It appears that the last four letters are incremented one letter at a ... > one character in the url and came across a link to a kiddie porn site... ... > that types in the string. ...
      (Full-Disclosure)
    • Re: coding an anagram function
      ... Any reason you cannot use the ASCII values of each character? ... contents are anagrams of each other. ... The cells will only contain letters, and no letter will appear more ... For this to produce a unique result for any given string, ...
      (microsoft.public.excel.programming)
    • RE: [Full-Disclosure] TinyURL
      ... Second, the whole idea behind tinyurl is to take long, difficult to type ... generate a string that was long enough so that the chance of someone ... URL service to pass along URL's to sensitive information, ... one character in the url and came across a link to a kiddie porn site... ...
      (Full-Disclosure)
    • Re: String/isUpperCase?
      ... >and counts the Upper Case letters. ... I tried isUpperCase but it was only doing ... >a character not the whole string. ...
      (comp.lang.java.help)