2 ms·
Even if Microsoft claim this is about security scanning, isn't it fairly trivial to configure your webserver to serve up different content depending on the User
by logifail 4y ago
Even if Microsoft claim this is about security scanning, isn't it fairly trivial to configure your webserver to serve up different content depending on the User-Agent request header?
BingBot scans the link, gets a dummy page with 'clean' content, Microsoft delivers the email message to the user, user clicks through the link with actual browser, gets phishing / malware content...
- hazmazlaz 4y agoYes, that is exactly what a motivated attacker would do to avoid their phishing site getting flagged as malicious. Here is a good article about how that is accomplished: https://rhinosecuritylabs.com/social-engineering/bypassing-email-security-url-scanning/ https://rhinosecuritylabs.com/social-engineering/bypassing-e...
- eli 4y agoSure, or even just ignore user agents if you know your target has this scanning in place, just send the malware to the 2nd click. It's not just MS. Lots of enterprise email security stuff works like this.