Hackers found a way to bypass Microsoft Office 365 Safe Links
Security researchers have just revealed how hackers overcome Microsoft Office 365's Safe Links security feature, used to protect users from malware and phishing attacks.
Security researchers have just revealed how hackers overcome Microsoft Office 365's Safe Links security feature, used to protect users from malware and phishing attacks.
Safe Links is included in Office 365 software, located in Microsoft's Advanced Threat Protection (ATP) solution, replacing all the URLs in email with Microsoft's secure URL.
When the user clicks on the link in the email, it will be sent to the domain name for Microsoft owned to check the origin of the URL. If it detects malicious code, it will warn the user and if not, will redirect the user to the original link.
However, researchers at Avanan cloud security company have revealed how to use this feature using a technique called baseStriker.
BaseStriker uses the tag in the header of the HTML email, used to define the default URL or URL for related links in the website or text.
If the URL is defined, all related links will then use that URL as a prefix.
Traditional scam
BaseStriker attack type
As shown in the above two pictures, when using a card to separate the infected link, Safe Links cannot identify and replace the link, and the user is still taken to the infected page when clicked.
Researchers have tried using baseStriker and said 'anyone who uses Office 365 with any installation settings is likely to be affected', whether web, mobile or installed on the destkop.
Proofpoint is also likely to be affected. Gmail users or using Office 365 with Mimecast are not.
See more:
- Microsoft Office 365 version is supported against blackmail
- Hackers are using new Microsoft Office vulnerabilities to distribute malware
- Hacker exploited three vulnerabilities in Microsoft Office to spread Zyklon malware
You should read it
- 25% of 'over-the-counter' phishing emails are the default security of Office 365
- What is Office 365 Attack Simulator? How to use it?
- [Infographic] How to recognize and prevent Phishing attacks
- Microsoft warns of phishing campaigns targeting Outlook Web App and Office 365 users
- Excel continues to be used as a lure for online fraud with complex mechanisms
- Hacker purged two-factor security just by automated phishing attacks
- Hackers use banks as a starting point for phishing attacks
- Air New Zealand hacked, customer information is at risk of falling into the hands of hackers
- Hackers are using new Microsoft Office vulnerabilities to distribute malware
- Warning: Microsoft and Google Clouds are being abused to launch large-scale phishing campaigns
- [Infographic] 4 types of Phishing are easy to trap users
- The browser is too smart, hackers turn to embed zero-day Flash malicious code into Microsoft Office files