The NoRelationship Attack Bypasses Office 365 Email Attachment Security

guest · Feb 20, 2019

The NoRelationship Attack Bypasses Office 365 Email Attachment Security
February 19, 2019
https://www.avanan.com/resources/the-norelationship-attack-bypasses-office-365

Avanan identified a new phishing attack that bypasses EOP (Exchange Online Protection) URL filters, which scan Office documents like Word (.docx), Excel (.xlsx), and PowerPoint (.pptx).

The attack emails include a .docx attachment containing a malicious link that leads to a credential harvesting login page. Link parsers that do not scan the full document, but rely instead on a relationship (xml.rels) file for the list of links included in the attachment, fail to identify the malicious URL.
Conclusion
By removing the malicious links from the document.xml.rels relationship file, hackers confused link parsers that only scan the relationship file for external links. It seems there are no shortcuts to be had in email scanning. The only solution is to scan the entire file.
Click to expand...

Log in or Sign up

The NoRelationship Attack Bypasses Office 365 Email Attachment Security

guest Guest

Log in or Sign up

The NoRelationship Attack Bypasses Office 365 Email Attachment Security

guest Guest

Useful Searches