Skip to main content

McAfee Secure Short-URL Service Easy to Foil

McAfee have launched a Beta URL shortening service with added security features. As Brett Hardin pointed out they are a little late to the game. However, there are so many abuses of URL shortening services that I commend them for trying.

Basically, what their service does is allow you to create short easy URLs (like any other service). However, unlike other services, when you click on the link, it opens a frames page with the content in the bottom frame and the McAfee information in the top frame. This information includes details about the domain you are connecting to, the type of company it's registered to and a big green tick or red cross to tell you whether the site is safe or not. This is decided by their 'Global Threat Intelligence', which will block known bad URLs and phishing sites. That's good, if it works.

I said above that I commend them for trying to provide this service. There are some obvious failings in their solution though, that render their protections useless other than to make it easier for people to phish users as the page has the McAfee stamp of approval. Below is their site working properly to block a known bad phishing URL.


As you can see, this site was blocked and marked as a phishing URL, which it was. Excellent, it's working! Hold on a minute though. Have a look at the screenshot below where I can access the same URL through their service by embedding it in an iframe. I now get the big green tick and I'm told that it is safe. You can see from the source that the iframe is showing the exact same URL as was blocked before. Incidentally, the page says that the site is a Business Internet Services company, which is extremely misleading as I can assure you that this wasn't put on a domain run by a Business Internet Services company.


Also, what about if I code my page to not accept being in a frames page? Then the service falls down again. The screenshot below is of Twitter accessed through this service. The problem is that I can hide all sorts of other links in the page to fool McAfee and the user won't see them. I know McAfee will block these URLs in time, but they will only be blocking the host page and they will have to block all of them. Also, if you click on a link within the page that directs you to another domain, then that is not checked, so I could just redirect you to a phishing URL and you'll still get the big green tick.


It's a nice idea, but it just doesn't work. Interestingly, other services also have some security in them. TinyURL, for example, wouldn't allow me to create a short URL for this phishing site in the first place as it was recognised as such. McAfee happily let me produce the short URL, they just blocked it later - not such a good strategy in my opinion. I know that a new phishing URL would fool TinyURL as well, but I particularly chose a URL that had been around for the best part of a month to give them a chance and I think TinyURL has done better. Incidentally, TinyURL also allowed me to produce a short URL for my test page. One good thing about TinyURL is the preview facility, but that doesn't protect me against a site that looks like the real thing.

Moral: follow any links at your own risk and don't think that a green tick makes it safe!

Comments

  1. This comment has been removed by a blog administrator.

    ReplyDelete

Post a Comment

Popular Posts

You say it's 'Security Best Practice' - prove it!

Over the last few weeks I have had many conversations and even attended presentations where people talk about 'Security Best Practices' and how we should all follow them. However, 'Best Practice' is just another way of saying 'What everyone else does!' OK, so if everyone else does it and it's the right thing to do, you should be able to prove it. The trouble is that nobody ever measures best practice - why would you? If everyone's doing it, it must be right.

Well, I don't agree with this sentiment. Don't get me wrong, many of the so-called best practices are good for most organisations, but blindly following them without thought for your specific business could cause as many problems as you solve. I see best practice like buying an off-the-peg suit - it will fit most people acceptably well if they are a fairly 'normal' size and shape. However, it will never fit as well as a tailored suit and isn't an option for those of us who are ou…

Coventry Building Society Grid Card

Coventry Building Society have recently introduced the Grid Card as a simple form of 2-factor authentication. It replaces memorable words in the login process. Now the idea is that you require something you know (i.e. your password) and something you have (i.e. the Grid Card) to log in - 2 things = 2 factors. For more about authentication see this post.

How does it work? Very simply is the answer. During the log in process, you will be asked to enter the digits at 3 co-ordinates. For example: c3, d2 and j5 would mean that you enter 5, 6 and 3 (this is the example Coventry give). Is this better than a secret word? Yes, is the short answer. How many people will choose a memorable word that someone close to them could guess? Remember, that this isn't a password as such, it is expected to be a word and a word that means something to the user. The problem is that users cannot remember lots of passwords, so remembering two would be difficult. Also, having two passwords isn't really…

Security is a mindset not a technology

I often get asked what I look for when hiring security professionals and my answer is usually that I want the right attitude first and foremost - knowledge is easy to gain and those that just collect pieces of paper should maybe think about gaining experience rather than yet more acronyms. However, it's difficult to get someone to change their mindset, so the right attitude is very important. But what is the right attitude?


Firstly, security professionals differ from developers and IT engineers in their outlook and approach, so shouldn't be lumped in with them, in my opinion. The mindset of a security professional is constantly thinking about what could go wrong (something that tends to spill over into my personal life as well, much to the annoyance of my wife). Contrast this with the mindset of a developer who is being measured on their delivery of new features. Most developers, or IT engineers, are looking at whether what they have delivered satisfies the requirements from t…