3 ms·
I find it a little bit dubious that this social engineering evasion is what caused the false negative in phish detection. This guy expects the automated scanne
by 13of40 3y ago
I find it a little bit dubious that this social engineering evasion is what caused the false negative in phish detection.
This guy expects the automated scanner to render the filename graphically, OCR it, then use the backwards result to guess the file type?
Because first of all, "foo.eml" and "[RLO]bar.eml" are both EML files to any programmatic scanner, and second they look at the content of the file to figure out what it is, not the extension.
- dave4420 3y agoNo, this guy expects the automated scanner to detect that bidi overrides are being abused, and block it based on that.
- 13of40 3y agoThat's the kind of heuristic rule that's going to come back and bite you when you try to scale up to half a billion attachments a day.
- Dylan16807 3y agoI think it's pretty good. No sane human uses those in casual text. Trying to carve out exceptions could become a complex biting situation, but flat-out blocking/replacing them shouldn't.