No surprise: phishing attacks are on the rise, and an old technique is now--again--getting increasingly popular: open redirect flaws. These flaws allow attackers to redirect victims to malicious websites, even if the link in the phishing email appears to be legitimate.
How do open redirect flaws work?
Open redirect flaws occur when a website permits users to input their own URLs into a redirect link. If the website does not validate or sanitize these inputs properly, attackers can use the flaw to redirect victims to malicious websites. For instance, attackers may send phishing emails that contain a link to a legitimate website, such as bankofamerica.com. However, the link could actually redirect recipients to a malicious site that resembles the real Bank of America site.
To protect yourself from open redirect attacks, follow these steps:
- Be cautious of links in emails from unknown senders.
- Don't click on links in emails with typos or grammatical errors.
- Hover over the links in emails to see the actual URL before clicking on them.
- Use a security solution that can detect and block open redirect links.
Organizations can also take measures to protect themselves from these types of attacks, such as providing security awareness training for employees on how to identify social engineering and phishing emails.
Here are some additional tips for recognizing open redirect flaws in phishing emails:
- Look for a URL shortener service. Attackers often use URL shorteners to conceal malicious links in phishing emails.
- Always examine the URL of the link carefully. If it contains strange characters or parameters, it is best not to click on it.
- Hover over the link before clicking on it. This will allow you to verify that the link points to the website it claims to be rather than malicious content.
- When in doubt, it's always best to be cautious and avoid clicking on it.
By educating employees on open redirect flaws and paying close attention to the links in emails, you can reduce the risk of becoming a victim of these flaws in phishing attacks.
New-school security awareness training can enable employees to follow security best practices and avoid falling for phishing and social engineering traps.
HelpNet Security has the full story.
