2

Background

A few years ago we wrote a 301 redirect script that could be used by our clients to establish first party cookies before redirecting to their site (which in turn contained an iframe of ours which by that point could create/read first party cookies).

Something like http://www.ourdomain.com/redirect?return=http://clientdomain.com/clientpage

Which would establish a first party cookie then issue a 301 to the return parameter.

Issue

We have noticed a dramatic increase in seemingly malicious requests for this page, with odd destination parameters. For example:

  1. /redirect?return=http://bfvev.freetzi.com
  2. /redirect?return=http://www.youtube.com/watch?v=l456e7O9ZGY
  3. /redirect?return=http://www.cognoschina.net/home/link.php?url=http://www.tklife.com.cn/home/link.php?url=http://www.kamyarshah.com/Marketing/
  4. /redirect?return=http://www.m-bo.ru/bitrix/rk.php?goto=http://Abolished-your-mythology.tumblr.com/post/77355569234/shiv-shankaran-nair-the-deal-architect
  5. /redirect?return=http://www.superdoctors.com/redirect?r=http://www.tklife.com.cn/home/link.php?url=http://www.kamyarshah.com/Marketing/
  6. /redirect?return=http://www.slider.com/r.php?url=http://www.tklife.com.cn/home/link.php?url=http://www.kamyarshah.com/Marketing/
  7. /redirect?return=http://ufacity.info/bitrix/redirect.php?event1=&event2=&event3=&goto=http://www.tklife.com.cn/home/link.php?url=http://www.kamyarshah.com/Marketing/
  8. /redirect?return=http://www.x666xx.ru/redir.php%3Fhttp%3A//gesundheitstest.org/%3Fs%3Dzurueckbegleitendes
  9. /redirect?return=http://www.dloutstanding.com/home/link.php?url=https://www.youtube.com/watch?v=E3xd_YTntRw
  10. /redirect?return=http://www.thehighguy.ca/groups/does-a-link-developing-instrument-work-751305441/

Many of these are simple redirects to other domains (#1, #2, #10).

Many are 301s to other sites that look like they'll issue 301s as well - someone is chaining 301s (#3, #4, #5, #6, #7, #8, #9).

In some cases, someone is using us and a set of different third party 301 scripts to get to their ultimate destination (#3, #5, #6, #7) !

Question

Why? What would motivate someone to hand craft links like these and post them on forums (I checked some of the referrers). I can't really see what anyone has to gain by doing this.

The only thing I can think of is that they're hosting malicious content at the ultimate destination and are trying to fool simple browser addons that validate a link's trustworthiness (eg. Avast has a Chrome addon that checks the rating of links in Google).

Does anyone have any ideas why? (And yes, we are about to implement a whitelist for domains that can use this redirect page).

Thanks.

  • 2
    Oh heck! It has been over a decade since I have seen hackers use a redirect script. It was very common at one point. With so much abuse, redirect scripts were either hardened or not used. It can be a whole host of reasons for a hacker to do this, one of which is making their identity harder to determine. You need to immediately modify your script! You do not want this on your site. You will need to validate your customers domains names before allowing this to work. Or something within your business model that will ensure that hackers can no longer use this script. Cheers!! – closetnoc Oct 1 '16 at 16:00
  • Aside: "contained an iframe of ours which by that point could create/read first party cookies" - If that iframe on their site contains a document from your site (as I think you are referring) then the "first party" cookie that was set during the redirect (on your site) is now considered a "third party" cookie when accessed in the iframe, so cannot be read (or written) unless "third party" cookies are allowed in the browser. – MrWhite Oct 10 '16 at 14:42
  • "hand craft links" - these are not necessarily hand crafted. Your script is possibly being used by an organised botnet using hacked accounts on various forums in order to spread these malicious links. – MrWhite Oct 10 '16 at 14:52
1

Links like this are often used to bypass spam filters. They are obscuring the final spammy destination with a URL that appears to point to your site. The forum software likely has anti-spam measures that are fooled by this technique.

This is bad for your site because this will ultimately get your site added to the list of spammy sites. When you implement a redirect, it is best to whitelist the domains to which you can redirect. I typically allow redirects to my own domain name, and allow relative URLs.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.