Old Dog, New Trick: Hackers Use Logons in URLs to Bypass Email Scanners
A new phishing method uses a decades-old special URL format to take advantage of how security solutions and email clients interpret URLs, tricking victims into clicking.
It’s called the HTTP Authorization header and it’s been around since 1999 as part of RFC 2616 which defined HTTP version 1.1. It specifies that an HTTP web request can contain a username and password in a URL just before the fully-qualified domain name. For example:
https://username:password@notarealdomainname.ext
Everything after the double forward slash and before the “@” is interpreted as authentication credentials. A new phishing method spotted by security researchers at Perception Point found that scammers were taking advantage of the “@”, placing it in what would be perceived as the “middle” of a valid URL, only to trick email clients and scanning solutions into interpreting the URL as being benign, when it was anything but.
Take the idea of tricking a user into thinking they were going to be taken to the following URL:
http://www[.]office[.]com[/]login
But the URL actually reads:
http://www[.]office[.]com[/]login@maliciousdomain[.]com
With many web browsers, everything before the “@” is considered authentication details and the destination domain is everything after the “@”. In contrast, the email scanners may not interpret the URL properly at all and deem it not to be a threat.
In the case of the attack found by Perception Point, the URL in question is found in the following image:
The actual URL is the Bitly link which takes victims to a spoofed Microsoft 365 logon page.
The only saving grace would be found in those users that know to scrutinize the final URL they are taken to (which was not Microsoft 365) before they provide credentials. Users that undergo continual Security Awareness Training are taught to always be on guard looking to anything out of the ordinary – whether it be a link with an “@” in the middle of it, or an incorrect URL on a logon page.
Free Phishing Security Test
Would your users fall for convincing phishing attacks? Take the first step now and find out before bad actors do. Plus, see how you stack up against your peers with phishing Industry Benchmarks. The Phish-prone percentage is usually higher than you expect and is great ammo to get budget.
Here’s how it works:
- Immediately start your test for up to 100 users (no need to talk to anyone)
- Select from 20+ languages and customize the phishing test template based on your environment
- Choose the landing page your users see after they click
- Show users which red flags they missed, or a 404 page
- Get a PDF emailed to you in 24 hours with your Phish-prone % and charts to share with management
- See how your organization compares to others in your industry
PS: Don’t like to click on redirected buttons? Cut & Paste this link in your browser: https://info.knowbe4.com/phishing-security-test-partner?partnerid=001a000001lWEoJAAW