Forest Global Training Partners

Cyber Risks · Krebs on Security

Spammers Abusing Trust in US .Gov Domains

Summary: Spammers are exploiting open redirects on U.S. state government websites, such as a South Dakota redirect at dss.sd.gov, to route users through trusted .gov domains to spammy or potentially malicious sites. Because bit.ly automatically shortens any .gov or .mil URL to a 1.usa.gov link, these redirects can be disguised as official-looking government links, and Krebs found bit.ly allowed clicks on nearly all shortened malicious links that did not end in .exe.

Key Takeaway: Symantec found in October 2012 that about 15 percent of all 1.usa.gov URLs were used to promote spammy messages, and the same open-redirect weakness was still exploitable nearly four years later. A link that appears to carry the federal government's stamp of approval can land a user on a malware-hosting page, and the filtering in place let most of Krebs's test links through.

Read the original at Krebs on Security ↗

Topics
Data Breaches
Related