News for hackers. Stuff that matters.

A comment on Kobold letters: Why HTML emails are a risk to your organization. Parent comment

Re:Kobold letters: Why HTML emails are a risk to your organi... by seethishat on Thursday April 04, 2024 @01:17PM (#39933271)
Many phishing simulation systems are not technically correct. Microsoft, Google and other 'security vendors' may inspect links in emails. That link inspection can sometimes be blamed on the end user. "You clicked the phishing link, now you have to take remedial security training!"

The only way to know for certain that a user fell for a phish, during a simulated exercise, is to make an HTML form that does a HTTP POST request and contains the user's credentials (that only they could type in). If a user enters their username and password and clicks submit, then they fell for the phish, otherwise no one can say for sure who or what software clicked that link that did a simple HTTP GET.

[ Parent | on HN ]
Re:Kobold letters: Why HTML emails are a risk to your organi... by w3ll_w3ll_w3ll on Thursday April 04, 2024 @05:17PM (#39935909)
Microsoft Safe Link technology does not actually inspect the link until the user clicks on the link. This is to avoid that confirmation links, used by some service to confirm registratio or as 2FA, may be triggered by the security engine without user consent.
[ Parent | on HN ]
Re:Kobold letters: Why HTML emails are a risk to your organi... by caddy on Friday April 05, 2024 @04:25AM (#39939943)
Our workplace outlook phishing protection does though. I was signing up to test one of our apps recently and my email was auto confirmed in 5 seconds despite me never receiving it. Turns out it was caught in the phish filter which automatically clicked the link to check it, so the above is not always true. Confirmed this with a few co-workers too.
[ Parent | on HN ]