Symantec Video Highlights the Dangers of Shortened URLs

Lifehacker linked to a Symantec video showing the dangers of shortened URLs. What is a shortened URL? When using an application like Twitter with a character limit, it's not always possible to include a long link to a website, video, or article that you'd like to share with others. You then go through a URL shortener to create a shorter link that can be shared with a brief comment in under 140 characters. URL shorteners have been around for years, but I didn't start using them until Twitter came along.

Picture by ShiYali

URL shorteners can be convenient and useful. The problem is, they can also be used to hide malicious sites. How can you tell a malicious site?

If you click on a link, and immediately get what looks like a Windows notification telling you that your computer has a virus, GET OUT OF THERE! If the virus notification recommends a specific program to take care of the problem, GET OUT OF THERE! Just close the windows. If they won't go away, restart your computer.



A common tactic of spyware is to tell you that you have spyware, then tell you a certain program will fix it. You PAY for that program, which tells you it cleaned up the spyware, but it really infects you with other spyware. You might start getting pop-up windows for porn or other spyware software.

Here are some ways you can tell if a website is malicious:

• If it's unsolicited, then it's automatically suspect.


• If it has ANYTHING to do with porn, especially if it's unsolicited, it's suspect.


• If you don't know the person sending you the link, it's suspect.


• If it is from a person you know, but seems out of character for them, it's suspect (like, if it comes from me, but says something like "hey check out my awesome site LOL" then it's way out of character. I don't write like that. I'd say "Hey, check out my awesome site". It's a subtle difference, but an important one.)


• If it requires you to download software, it's suspect, unless you don't already have Windows Media Player, iTunes, QuickTime, Flash, Real Player, and other common viewers and players on your system.

I've had to clean up plenty of computers after spyware attacks. I fell for one once. Early in the days of MySpace, I used to check the profiles of anybody sending me a friend request. At one point, I was getting a lot of porn solicitation. I had a friend request one day, clicked on the profile, and was told I had to download something called "MySpace Viewer" to see it. Without thinking, I clicked on the download link and started installing the program. Right then, I realized I'd fallen for a malicious attack. I also Googled "MySpace Viewer" and confirmed that it was spyware. I couldn't uninstall it, but was able to do a System Restore to fix the problem.

I have several friends who will click on ANYTHING that says "Your computer is infected with spyware. Click here to buy the $40 "xxxx Spyware eliminator" (where xxxx is a filler for the name of whichever one is running today). They spend the $40, and buy a program that delivers spyware. I'm going to start telling people to call Visa and try to dispute the charge. In fact, if you've fallen for one of these attacks, give it a try. Call Visa, explain the situation, ask to dispute the charge because you were duped, and let me know in the comments if it works. Visa is supposed to offer consumer protection and these sales are fraudulent, so it seems to me like this should fall under a consumer protection clause.

Here's Symantec's video showing how this works.

Have you ever fallen for a spyware/virus attack? How did you fall for it?