“Why worry about the destination of a link..
.. if it doesn’t end up being the place I want go, I’ll just go back or close the tab, no harm done right?”
Unfortunately, as we’re all becoming more and more aware, the above is not the case. Even just clicking a malicious link can be enough to trigger a malicious script to be run on your computer, even if you quickly leave the page after realizing it’s not going where you expected it to go.
The other side of the coin is, maybe the link brings you to a page that looks exactly like the page you were expecting it to bring you to, for example, a MyTrent Login looking page. It doesn’t sneakily install malware, instead it’s waiting for you to provide them with your username and password voluntarily, because you think you’re at the real trentu.ca/mytrent when in reality you could be a trentumytrentloginpageforreal.ru.
AODA requires that links be hidden behind readable text so that screenreaders don’t end up reading a very long, non-sensical url string out to user that need to use specialized accessibility software. This, by design, hides the location of the link, all the more reason to check to make sure it’s safe before clicking.
If you’ve noticed, in every blog entry I’ve done so far I’ve hidden the urls. This is just the way things are now so we need to know what to do to ensure we stay safe.
Examples of how links can mislead you
Link text can say anything it wants, but it doesn’t mean that’s where it’s going.
For example, have a look at the link below. I’ll make it look like it’s going to Google, but it’s actually going to go to Bing.
You can take my word and click it to see, OR you can take your computers’ wellbeing into your own hands and hover your mouse over it to force it to show you the true location. (If you’re on mobile, long-press it. If it doesn’t show you where it’s going, select 'copy url', then paste it somewhere to see where it actually is trying to go.)
Try it now, hover over this link:
google.com
See how it's actually saying it's going to go to https://www.bing.com?
(if you don't see anything pop up when hovering, look to the bottom left of your window. Alternatively, right-click and copy the link, then paste it using ctrl-v somewhere else to have a look at it.)
Here’s another example of a link hiding its ultimate destination:
This is an example of a link shortener. Other examples are 't.co' used by Twitter, 'bit.ly', 'ow.ly'. There are more. The point is, you can’t tell at all where they’re going by looking or hovering over them.
If you hover over it, you’ll see it’s not a trick, it is going where it says it’s going, but where is that exactly?!
Let me introduct you to another tool for your arsenal: Wheregoes
If we go to that site, and put that 'tinyurl' link in it, it will test it for you and show you where it’s actually going.
Let’s do that now:
When you click the ‘Trace URL’ button, you’ll get the following:
OK, that’s better. We can now see that it’s going to something on www.youtube.com. You don’t know what video exactly but at least you can tell the link is legitimate (because we know and trust youtube.com). And if you were expecting a link to a video, then good, click it, it’s probably what you’re looking for.
However if you were initially told the link is to an article on The Globe and Mail, you can clearly see it is not, in that case you would not click the link as you've now uncovered that someone was trying to dupe you.
Speaking of being duped into clicking a link...
You can’t talk about link-trickery without including a reference to a 'rickroll' (being tricked into clicking a YouTube link to Rick Astley’s ‘Never Gonna Give You Up’ Music Video under the pretences of being sent to another, more useful, location)
The shorted link above (<-- and this one) actually goes to a NEW version of that video. An AI up-scaled version to 4k that is mind-blowing.
The detail is insane compared to the original!
New Version video link, and pic below:
Original video link, and pic below:
The magic of artificial intelligence. Anyway, I digress.
Also, did you try hovering over the two links above to see where they were going? Notice how it was going to 'youtu.be' and not our expected 'youtube.com'. That's an example of YouTube's link shortener. Lots of sites have their own flavour. That could have been a red flag, but in this case we know it is also legitimate.
You’ll never be fooled again!
So there you go. A new tool to try, and a trick to see where links are really going. These are great defences to phishing emails and other link-trickery you may come across. Use them well.
Share your knowledge with your friends and co-workers and together we’ll make our own computers, and Trent’s, that much safer.
I will leave you with this gem of a quote that I'm reminded of here, and that’s never left my head since I heard it:
“There's an old saying in Tennessee — I know it's in Texas, probably in Tennessee — that says, fool me once, shame on — shame on you. Fool me — you can't get fooled again.” – George W. Bush
Back to Cybersecurity Blog home.
Stavros Tzagadouris - Level 1 Information Security Officer - Trent University