From the archive (2009): Cligs got hacked, restoration from backup started
On 15 June 2009 an attacker used a hole in the link editor to point 2.2 million Cligs short links at one page. The founder's own account of the day, as an excerpt.
From the archive. This post appeared on blog.cli.gs on 15 June 2009, written by Pierre Far, who founded and ran the Cligs URL shortener. We publish an excerpt here because the original address is still linked from around the web; the complete original is preserved in the Wayback Machine. A note from today follows the excerpt. The background is in cli.gs, 2008 to 2026.
Late last night/early this morning, a security hole in the cligs editing functionality was discovered and was exploited by a malicious attacker. The attack edited most URLs on Cligs to point to a single URL hosted on freedomblogging.com. I've identified the hole and disabled all cligs editing for now and I'm restoring the URLs back to their original destination states.
However, the most recent backup is from early May, and so we may have lost all URLs created since then. My daily backups with my host were turned off for some reason, which is another story. The restoration will take a long time, it's millions of URLs that have to be individually restored, and so you may not see your proper links till tomorrow.
Update 2009-06-15 at 1156: It's about 2.2 million URLs that got affected.
What happened next
The incident was covered by The Next Web, SANS Internet Storm Center, Kaspersky's Securelist and iTnews, and it is still cited in papers on the security of URL shorteners: a shortener is a single point of failure for every link that passes through it. The update of the following day has the numbers: 93% of the links came back from backup, 161,232 did not. The lesson shaped how cli.gs works today. A cli.gs affiliate link is not a stored pointer that an editor can change; its reference code is signed, and the shop reports the sale back with that code. How that works.