Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

How do you think could we secure hyperlinks pasted by users on website's forums, comments, blogs against bad links/leading to malware etc.?

I thought about google safe browsing, projecthoneypot.

Did you address this problem and if can avoid bad links problem?

share|improve this question
1  
Checking with those might help. However, with the profusion of URL shorteners, it's not possible to avoid the problems altogether. –  Piskvor Apr 25 '12 at 11:09
    
So there we should use URL redirects follower which resolve these URLs. –  skomak Apr 25 '12 at 11:42
1  
I don't see url shorteners as a problem. Just blacklist them, they're annoying anyways. –  CodesInChaos Apr 25 '12 at 12:12
    
It is good advise. –  skomak Apr 25 '12 at 12:13
2  
Not allowing users links at all, or not allowing them to post links until they've earned some kind of reputation in the community? You aren't going to catch all links, but this kind of thinking will stop the spam bot kind of ones. –  ewanm89 Apr 25 '12 at 15:04
show 3 more comments

3 Answers

In general, there's no way to vet links unless you have significant resources. Even if you visit the site, the domain may expire and be acquired by a malware distributor who wants to benefit from the old owner's reputation.

You need to white-list protocols, e.g. only allow http, https, and mailto. javascript: links cannot be trusted.

Besides that, you can rely on most modern browsers to include some kind of malware checking, and possibly not serve links to older browsers.

Either way, you should use nofollow to make sure that malware trackers do not conclude that these links are more reliable because your site links to them or that your site is less reliable because it links to them.

share|improve this answer
    
"Even if you visit the site" the website could fingerprint the tools and IP addresses you use to download the content (naively by user-agent header, with an advanced behaviour analysis system to distinguish HTTP bots from humans), so he could show "safe" content to your checking bot and "unsafe" content to others. You could make this fingerprinting more difficult by changing HTTP client, and using proxies or even Tor. –  curiousguy Aug 1 '12 at 16:54
    
(...) But unless you are ready to frequently recheck the content of a resource (with various web clients and various proxies to avoid detection), there is simply no way to even have a higher bound on the success probability of such advanced attacks. The alternative is to copy the content on a webserver you control, and then check - and it has many other security issues. –  curiousguy Aug 1 '12 at 16:57
    
@curiousguy, Quite right. –  Mike Samuel Aug 1 '12 at 17:47
    
Would you also white-list the FTP protocol? –  curiousguy Aug 1 '12 at 19:16
    
@curiousguy, Probably not unless the nature of the forum requires it. It's not widely used, allows initiating downloads, and browsers continue to allow user name and password to be embedded in FTP URLs possibly enabling attackers to mask the origin by putting something that looks like a domain in the authority portion. –  Mike Samuel Aug 1 '12 at 19:34
add comment

URL shortening services are a great way to leverage an XSS or CSRF vulnerability because it obscures the request from the user. McAfee provides a secure url shorting service.

Its trivial to see if a link is redirecting, with a HTTP header. CURL can automatically follow HTTP header redirects, however meta-redirect and JavaScript redirects is more difficult.

There are two things you can check. You can verify that the URL isn't on the Google Safe Browning blacklist using Google's api. You could also verify that it doesn't have JavaScript in it. This part is a little harder because of encoding, but still pretty simple to implement.

share|improve this answer
add comment

If the question is what a service provider (i.e. webhost) can do to reduce the likelihood that a malicious link is posted on your site, there are a few available methods. I recall that Websense offers a service, Threatseeker cloud, a web service where service providers can use to verify whether a link (shortened or not) belongs to any number of pre-defined categories (i.e. adult, malicious, etc). I'd guess there are other vendors and ventures aimed at providing this type of service to service providers.

Aside from checking each posted link before its published, you can always look at other technical controls mentioned in the other answers or perhaps a simple administrative/social control to ensure only registered users can post. You can add on the requirement for moderation by a moderator or add on the social component to require posting of links only be available to registered users after some measure (i.e. positive votes, reputation, etc).

Lastly, you could always mask links so the user has to copy/paste it into their browser. But this approach moves the burden back on the user.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.