Research Article
Analyzing Security Risks of Ad-Based URL Shortening Services Caused by Users’ Behaviors
@INPROCEEDINGS{10.1007/978-3-030-90022-9_1, author={Naoki Fukushi and Takashi Koide and Daiki Chiba and Hiroki Nakano and Mitsuaki Akiyama}, title={Analyzing Security Risks of Ad-Based URL Shortening Services Caused by Users’ Behaviors}, proceedings={Security and Privacy in Communication Networks. 17th EAI International Conference, SecureComm 2021, Virtual Event, September 6--9, 2021, Proceedings, Part II}, proceedings_a={SECURECOMM PART 2}, year={2021}, month={11}, keywords={Url shortening service Online advertising}, doi={10.1007/978-3-030-90022-9_1} }- Naoki Fukushi
Takashi Koide
Daiki Chiba
Hiroki Nakano
Mitsuaki Akiyama
Year: 2021
Analyzing Security Risks of Ad-Based URL Shortening Services Caused by Users’ Behaviors
SECURECOMM PART 2
Springer
DOI: 10.1007/978-3-030-90022-9_1
Abstract
URL shortening services make URLs shorter and simpler. Ad-based URL shortening services display advertisements to users who access short URLs and reward short URL creators. However, ad-based URL shortening services have specific security risks that URL shortening services without ads do not, such as displaying malicious advertisements to users. In this study, we reveal previously unknown security risks of these services caused by users’ behaviors. We conducted a comprehensive measurement of ad-based URL shortening services. First, we accessed short URLs of these services, clicked buttons on the web pages, and reached the final destinations of the short URLs. Then, we reveal the security risks posed to users by monitoring and analyzing traffic logs when such short URLs are accessed. We found that all services generated an average of 86.5 web requests to malicious domain names per short URL. We then showed the security risk of unintentionally communicating malicious domain names even when users click only on buttons that correctly move users to their desired destinations. Finally, we discuss countermeasures to mitigate these risks from the perspective of each stakeholder in ad-based URL shortening services.
