3 ms·
Imagine that you have put malware in xyz.com/mybadpage1, xyz.com/mybadpage2, and xyz.com/mybadpage3 pages. MS flags you, and you query MS. They tell you they se
by krisoft 4y ago
Imagine that you have put malware in xyz.com/mybadpage1, xyz.com/mybadpage2, and xyz.com/mybadpage3 pages. MS flags you, and you query MS. They tell you they see malware on the first two urls. Now you gained information about their blindspots.
You can capitalise on this multiple ways. You can remove the first two and hope they remove the flag. You can design your next attack better so it is more like mybadpage3. Etc
- bell-cot 4y agoDisagree: $Evil_Site_Owner can easily test MS's blind spots by putting malware on numerous web sites, then seeing which of those sites are flagged. And if MS is not systematically scanning all the URLs...well, "MS failed to notice malware at $URL, which my web server logs say MS has not visited" is pretty useless information. (Not that I think MS should enumerate malicious URL's, unless $Site_Owner is paying for scanning service. A "we noticed malware at $URL" is generally 95% of the possible value of such disclosures.)
- JamesBarney 4y agoA bad actor can do the same thing by putting together Mybadpage1.com Mybadpage2.com Mybadpage3.com
- BoorishBears 4y agoExcept if you're a malicious actor you can also do: msscanninghoneypot1.com msscanninghoneypot2.com msscanninghoneypot3.com You're pigeonholing a bad actor's actions into good actor behavior, it doesn't work like that... edit: missed that multiple replies cover this