@inproceedings{10.1145/3038912.3052698,
author = {Chang, Li and Hsiao, Hsu-Chun and Jeng, Wei and Kim, Tiffany Hyun-Jin and Lin, Wei-Hsi},
title = {Security Implications of Redirection Trail in Popular Websites Worldwide},
year = {2017},
isbn = {9781450349130},
publisher = {International World Wide Web Conferences Steering Committee},
address = {Republic and Canton of Geneva, CHE},
url = {https://doi.org/10.1145/3038912.3052698},
doi = {10.1145/3038912.3052698},
abstract = {URL redirection is a popular technique that automatically navigates users to an intended destination webpage with- out user awareness. However, such a seemingly advantageous feature may offer inadequate protection from security vulnerabilities unless every redirection is performed over HTTPS. Even worse, as long as the final redirection to a website is performed over HTTPS, the browser's URL bar indicates that the website is secure regardless of the security of prior redirections, which may provide users with a false sense of security. This paper reports a well-rounded investigation to analyze the wellness of URL redirection security. As an initial large-scale investigation, we screened the integrity and consistency of URL redirections for the Alexa top one million (1M) websites, and further examined 10,000 (10K) websites with their login features. Our results suggest that 1) the majority (83.3% in the 1M dataset and 78.6% in the 10K dataset) of redirection trails among web- sites that support only HTTPS are vulnerable to attacks, and 2) current incoherent practices (e.g., naked domains and www subdomains being redirected to different destinations with varying security levels) undermine the security guarantees provided by HTTPS and HSTS.},
booktitle = {Proceedings of the 26th International Conference on World Wide Web},
pages = {1491–1500},
numpages = {10},
keywords = {hsts, redirection trail, url redirection, https, ssl/tls},
location = {Perth, Australia},
series = {WWW '17}
}