6 ms·
The big takeaway I have here is that security is a balance between usability and safety. In this case by having malicious links that were obfuscated (behind HTM
by er4hn 5y ago
The big takeaway I have here is that security is a balance between usability and safety. In this case by having malicious links that were obfuscated (behind HTML?) to appear as legitimate LinkedIn links, the target clicking them was compromised.
If mail clients were to open a modal for each link and say "Are you sure you want to go to https://LinkMeIn.com/totally-legit?email=victim123@gmail.com https://LinkMeIn.com/totally-legit?email=victim123@gmail.com" would this cut down on these attacks?
Taking the idea too far: A system like this would probably link to some sort of cloud database eventually to catch "emerging threats" (novel URLs that look malicious) but then would that in turn threaten end-to-end encryption of email by sending links in emails to a cloud tracker?
- _trampeltier 5y agoHave you seen an link in outlook? This safelink feature? You have almost no idea where you will go.
- dboreham 5y agoFor regular users, the answer to any question "Are you sure..." is always yes.
- ineedasername 5y agoEveryone is always sure. If they aren't the first few times then they quickly get in the habit of just clicking "okay".
- ASalazarMX 5y agoSigh. We had to disable Windows Scripting Engine company-wide because someone complained that his invoice won't download no matter how many times he tried. His invoice in this case was a ransomware payload that the browser was fortunately stopping. Some people care, some care some of the time, and some just don't care.
- tester756 5y agoso, why was it disabled then?
- ASalazarMX 5y agoChrome identified the ZIP download as malicious. It was sheer luck, otherwise the user would have opened the ZIP and executed the obfuscated VBS inside.
- wruza 5y agoFew years ago I almost self-signed Transmission-bt app bundle via Xcode CLI tools because OSX falsely detected some KeRanger malware in it and tried to remove the app. And I was committed to run it by any means, cause I was tired of uTorrent. Turned out it wasn’t a false positive, their dist site got pwned. Other than that, I’m very careful with pc security.
- sfgweilr4f 5y ago"Of course I'm sure I want to open this link." and yet the gunfighter did not know where the link actually led to
- millerm 5y agoI just wish all email clients would stop allowing HTML to hide an actual link. It needs to stop. Anchor tags and any type of onClick/onTouch event in an email should not do anything. Just stop letting them obfuscate the freaking address, it’s that simple. Tell the marketing people to go to hell, and no they cannot have their silly nicely printed link. :-)
- NikolaNovak 5y agoThis. On phones especially it's getting increasingly hard, as a nerd desiring to do so, to figure out what the sender's email address and link's HTML target are :<
- tshaddox 5y agoWhy do you want this specifically for HTML emails and not on actual web sites? Surely it’s just as much of a threat in either place.
- syrrim 5y agoEmail is push, websites are pull. If you never choose to visit a website, then you'll never see a link on it. Most of the websites you do visit already prevent obfuscating links. Emails just show up in your inbox when an attacker wants them to. We could of course change that, and have people only see emails from known contacts or that they have requested. However, this destroys a major value proposition of email. Instead, it makes sense to limit the ability for senders to obfuscate the contents of email.
- tshaddox 5y agoAn attacker could email you an unobfuscated link to a website which contains obfuscated links and the threat model is exactly the same. Both require only that the victim 1) trust an email enough to click a link and then 2) trust the destination of that link enough to do the unsafe thing. Unless your computer propagates the "untrustworthiness" of the link from the email client to the browser and continues to prevent unobfuscated links, it seems like you've gained very little.
- Veserv 5y agoSecurity is largely not a balance between usability and safety at the levels most companies operate at. Both usability and safety could have been achieved in this case by just not being vulnerable to the attack as was the case for many other browsers. Then you could click the link and still be safe without any usability tradeoff in this specific case. Obviously, there are ways to sacrifice usability to gain security, but it is by no means required or sufficient to do so. There are plenty of ways to completely demolish usability without gaining any safety. And even in cases where it is necessary to tradeoff, most problems are so far from the actual edge of what is possible that you only need to sacrifice a negligible amount of usability to gain order of magnitude improvements in safety if you are working with someone who knows what they are doing.
- eli 5y agoThis would generate a ton of "false positives" (go look at a link in a random email newsletter and see what the actual URL is). People who do a lot of email stuff on their phone would be trained to click Yes a hundred times a day. Meanwhile it seems very unlikely to stop such a determined attacker. They just need to compromise a site that you might plausibly want to visit, or create a convincing enough lookalike. The URL need not look suspicious. IMHO expecting users to be able to discern "safe" from "unsafe" links by just looking at them represents a failure of our infosec systems.
- nijave 5y agoYou shouldn't get compromised just clicking a link. There's generally multiple levels of isolation to allow running untrusted code (websites) on your machine/device and being able to break through this is a serious failing
- boredwithlife 5y agoHave you heard of Pwn2Own?
- DSingularity 5y agoNo it wouldn’t because so long as the bulk of emails hold valid links the users will on average be conditioned to click. Sometimes all it takes is for one insider to click to take down an organization.
- sureglymop 5y agoMy email client definitely does this. Called FairEmail, available for Android.