3 ms·

Where in the article does it suggest this? The two bullet points at the very top of TFA is what I cited to discredit this notion, I read it again and still have

Where in the article does it suggest this? The two bullet points at the very top of TFA is what I cited to discredit this notion, I read it again and still haven't found anything suggesting the communication platforms are submitting this themselves.

bombcar 3y ago
Falcon Sandbox is explicitly mentioned - which is a middleware that can be installed on various communication platforms (usually enterprise): https://www.crowdstrike.com/products/threat-intelligence/falcon-sandbox-malware-analysis/ https://www.crowdstrike.com/products/threat-intelligence/fal... Microsoft has "safe links": https://learn.microsoft.com/en-us/microsoft-365/security/office-365-security/safe-links-about?view=o365-worldwide https://learn.microsoft.com/en-us/microsoft-365/security/off... - Chrome has its own thing, but there are also tons of additional hand-rolled similar features. My main annoyance is when they kill a one-time use URL.
- deleted 3y ago
  [deleted]
- anonymousDan 3y ago
  Do you know if safe links is guilty of the issue in the OP?
  - bombcar 3y ago
    I suspect not because Microsoft is using their own internal system. However, it likely exposes the content internally to Microsoft. They do 100% break Salesforce password reset links, which is a major PITA.
tobyjsullivan 3y ago
I thought I read it in the article but I may have unconsciously extrapolated from and/or misread this part: “I came across this wonderful analysis by Positive Security[0] who focused on urlscan.io and used canary tokens to detect potential automated sources (security tools scanning emails for potentially malicious [links])” I don’t see any mention of messaging platforms generally. It only mentions email and does not suggest who might be operating the tooling (vendor or end users). So I seem to have miscredited that idea. [0] https://positive.security/blog/urlscan-data-leaks https://positive.security/blog/urlscan-data-leaks

bombcar 3y ago

Falcon Sandbox is explicitly mentioned - which is a middleware that can be installed on various communication platforms (usually enterprise): https://www.crowdstrike.com/products/threat-intelligence/falcon-sandbox-malware-analysis/ https://www.crowdstrike.com/products/threat-intelligence/fal... Microsoft has "safe links": https://learn.microsoft.com/en-us/microsoft-365/security/office-365-security/safe-links-about?view=o365-worldwide https://learn.microsoft.com/en-us/microsoft-365/security/off... - Chrome has its own thing, but there are also tons of additional hand-rolled similar features. My main annoyance is when they kill a one-time use URL.

deleted 3y ago
[deleted]
anonymousDan 3y ago
Do you know if safe links is guilty of the issue in the OP?
- bombcar 3y ago
  I suspect not because Microsoft is using their own internal system. However, it likely exposes the content internally to Microsoft. They do 100% break Salesforce password reset links, which is a major PITA.

tobyjsullivan 3y ago

I thought I read it in the article but I may have unconsciously extrapolated from and/or misread this part: “I came across this wonderful analysis by Positive Security[0] who focused on urlscan.io and used canary tokens to detect potential automated sources (security tools scanning emails for potentially malicious [links])” I don’t see any mention of messaging platforms generally. It only mentions email and does not suggest who might be operating the tooling (vendor or end users). So I seem to have miscredited that idea. [0] https://positive.security/blog/urlscan-data-leaks https://positive.security/blog/urlscan-data-leaks