URL scanning services such as URLScan, VirusTotal, or Cloudflare Radar automatically analyze websites for suspicious content. “For example, they check network requests, the reputation of the sites, or embedded scripts, thereby helping companies and individuals detect malicious websites early on,” explains Ali Mustafa. According to the CISPA researcher, many companies now use such services as an integral part of their security measures. For example, they automatically check links in employees’ incoming emails. But this is exactly where a risk arises that has received too little attention so far.
The Downside of Convenience
Today, web addresses often consist of more than just a link to a website. They frequently also contain so-called tokens—randomly generated character strings that serve as digital keys. Such links are used, for example, for password resets, passwordless logins, or quick access to documents and booking records. “This is extremely convenient for users. However, it can become a problem when URL scanning services publish these links. That’s because third parties can use them to access documents or personal information and, under certain circumstances, even carry out actions on behalf of the affected person,” explains Mustafa.
But why do the scanning services make the links public in the first place? “On the one hand, public scan feeds can demonstrate how comprehensive and fast their analyses are. Publishing the links might, so to speak, be part of their business model. On the other hand, the public feeds serve to share insights about suspicious URLs with others,” Mustafa continues.
Examining the Problem on a Large Scale for the First Time
Individual reports of published access links containing sensitive information have appeared from time to time in the past in blog posts or case studies from the IT security industry. However, the researchers wanted to know just how widespread the problem actually is. To that end, they developed the LEAKYLINKS analysis system. This allowed them to collect web addresses from the public feeds of six major URL-scanning services, filter out irrelevant entries, and use a large language model to automatically analyze whether the remaining links could provide access to sensitive personal information.
In total, the team automatically collected and analyzed more than two million URLs from six different URL scanning services and identified over 4,000 cases in which publicly accessible links allowed access to sensitive information with 97% precision. “These included, among other things, visa documents, government documents, and booking information. We were surprised ourselves by everything we found,” says Mustafa.
To ensure that the investigation itself did not become a data protection risk, the researchers placed great emphasis on ethical standards. They largely refrained from manually evaluating the content they found. Instead, the language model—run on secure internal servers—handled the automatic classification. This meant the researchers only had to review a small portion of the results themselves, and sensitive data was not transmitted to external AI services or any other third parties.
When they encountered actual data leaks, the researchers notified the affected organizations as well as the operators of the URL-scanning services under investigation, in accordance with the principles of responsible disclosure. The paper deliberately does not name the companies affected in order to prevent further harm.
Who is Monitoring the Published Links?
The researchers also wanted to know whether the published links were being monitored by third parties at all. To this end, they set up so-called “honeypages”—specially crafted decoy websites designed to track traffic. They ran these URLs through the scanning services and had them published on the services’ sites.
The results show that the public feeds are by no means going unnoticed. The researchers recorded automated visitors, access to embedded content, and other activities that went well beyond typical browsing behavior. Nevertheless, they remain cautious in their interpretation. “We cannot prove malicious intent,” says Mustafa. However, the observed traffic showed that published links are indeed accessed by third parties.
How to Reduce the Risk
According to Mustafa, there are various ways to significantly reduce the risk of data leaks. “Website operators could set shorter validity periods for sensitive access links or require additional security prompts. URL-scanning services should not display links with potentially sensitive content publicly by default.” According to the researchers’ calculations, even then, more than 99 percent of all scanned URLs would remain publicly available. “This would hardly limit the usefulness of the services, but it would significantly reduce the risk for those affected,” says Mustafa.
For him, the study demonstrates one thing above all: Security risks often arise not from individual errors, but from the interaction of different systems. That is precisely why, when developing digital security infrastructures, greater consideration must be given to the unintended consequences that their interaction can have.
