Little URLs Becoming Bigger Spammer Target

URL-shrinking services such as TinyURL.com, bit.ly, and cli.gs are convenient for turning long addresses into short ones. They're also convenient for helping spammers and malware makers hide their identities and guide unwary clickers astray.The surge in shortened-url service popularity has hardly gone unnoticed by spammers and hackers. The reconfigured urls provide a convenient alias tool for spammers casting their nets among Twitter users, for example. Already some observers are tracking large shortened url spam campaigns.

In the course of pointing out that the United States is the world's leading spam generator (we're responsible for one in six spams), security firm Sophos noted the effectiveness of url-shortening "to obscure links to offensive material or malicious websites, and then distribute the links in spam emails, as well as posting them on Twitter and other networks."

The Washington Post's Brian Krebs has a good guide to previewing the true url behind shortened ones here.

Whether or not people in the instantpost/instant response/instant click world of social networking can be persuaded to take the time to preview the actual destination hidden behind a size-reduced url is an important question, one the spammers are betting they know the answer to.

Whether or not you can persuade your employees not to click without looking first is another matter altogether. You can, and the security of your business demands that you must, either by education and policy enforcement, or by prohibiting altogether their use of services that present large and growing security risks.