4 ms·
Worry about CSS-based exfil. https://www.mike-gualtieri.com/posts/stealing-data-with-css-attack-and-defense https://www.mike-gualtieri.com/posts/stealing-data-
by yourapostasy 7y ago
Worry about CSS-based exfil.
https://www.mike-gualtieri.com/posts/stealing-data-with-css-attack-and-defense https://www.mike-gualtieri.com/posts/stealing-data-with-css-...
The security teams are correct in the training they run about these: report the suspicious email and leave the investigation to them, don't try to DIY the investigation. Note you aren't penalized for false positives (reporting a legitimate email as a phishing attempt).
- agurk 7y agoThat is a nifty way to steal data. Luckily I was running in a completely clean environment inside a VM so wouldn't be an attack that could have occurred this time.
- heavenlyblue 7y agoI don’t understand this attack: if attacker can control CSS on the page - then they probably can also control javascript. Which means they can extract any data from it.
- britch 7y agoI think the point was even if you disable JS in your browser to be "safe," there's the possibility of some nasty CSS on the page as well. Turning off JS does not make you safe.
- 0xffff2 7y agoOkay, but if I'm not supposed to click on unknown links, why do I even have a web browser installed on my work machine? 99% of the time I'm using it to access unknown and untrusted external websites.
- mikeash 7y ago“Note you aren't penalized for false positives....” I spot a critical flaw in this methodology.