Bit.ly Partners With Security Companies To Combat Short URL Hacks

Bit.ly, a URL shortening service popular among Twitter users, announced partnerships on 30 November with security companies VeriSign, Websense and Sophos.

The alliance is designed to bring a new level of security to URL shortening, which has increasingly been abused by spammers and attackers. Services like Bit.ly shorten URLs so that they fit the character limits of microblogging services like Twitter, or just for the sake of convenience. As a result, users can click the shortened links without knowing what site they will be directed to.

Each partnership is meant to add a new layer of protection. One is VeriSign’s iDefense IP reputation service. “The iDefense blacklist includes URLs, domains and IP addresses [that] host exploits, malicious code, command and control servers, drop sites and other nefarious activity,” said a 30 November post on the Bit.ly blog.

According to the blog post, Websense’s ThreatSeeker Cloud service will be used to “analyse the Web content behind Bit.ly links in real time, using heuristic tools and reputation data to flag spammy URLs, malicious content and phishing sites.” Finally, Bit.ly is employing Sophos for its behavioral-analysis technology.

The integration of the services is expected to happen during the next few weeks.

“Bit.ly is one of the largest sharing services on the Web, with millions of shortened URLs created every day,” Andrew Cohen, Bit.ly’s general manager, said in a statement. “A large part of our success is due to the trust users have in our service and we work hard to earn that trust by warning our users about spam and malicious content.”

According to Websense, users will be able to report spam to abuse@Bit.ly and have their feedback become part of the classification and threat protection for all Websense subscribers.

“I like the approach Bit.ly is taking to check existing links in case they’ve become compromised, rather than simply just scanning new links added to the database,” Rich Mogull, an analyst with Securosis, said in a statement. “This will reduce the chances of the bad guys gaming the system by adding a clean version of their site for an initial scan, then adding malware after the fact for future visits. This solution is a lot better than the anti-phishing built into browsers and some search engines, since those rely only on databases of previously discovered, known bad sites.”

Brian Prince eWEEK USA 2014. Ziff Davis Enterprise Inc. All Rights Reserved

View Comments

Share
Published by
Brian Prince eWEEK USA 2014. Ziff Davis Enterprise Inc. All Rights Reserved

Recent Posts

IT Glitch Disrupts Morrisons Christmas Shopping

Morrisons offers discounts after glitch causes promotions to not be applied for card holders, as…

4 hours ago

US Finalises Billions In Awards To Samsung, Texas Instruments

US finalises $4.7bn award to Samsung Electronics, $1.6bn to Texas Instruments to boost domestic chip…

13 hours ago

OpenAI Starts Testing New ‘Reasoning’ AI Model

OpenAI begins safety testing of new model o3 that uses 'reasoning' process to ensure reliability…

13 hours ago

US ‘Adding Sophgo’ To Blacklist Over Link To Huawei AI Chip

US Commerce Department reportedly adding China's Sophgo to trade blacklist after TSMC-manufactured part found in…

13 hours ago

Amazon Workers Go On Strike Across US

Amazon staff in seven cities across US go on strike after company fails to negotiate,…

14 hours ago

Senators Ask Biden To Extend TikTok Ban Deadline

Two US senators ask president Joe Biden to delay TikTok ban by 90 days after…

14 hours ago