- Security researchers warn of “hidden text sale” IE emails
- Hackers can hide parts of the text to confuse e -mail scanners
- The hidden text helps the e -mail to pass on the scans and countries in the inbox
Hackers are increasingly using “Hidden Text Salning” or “Poisoning” techniques to work around E -mail security measures and get phishing messages to land in people’s inboxes.
A new in-depth guide published by cyber security researchers from Cisco Talos outlines how cyber criminals abuse HTML and CSS properties in email messages, set the width of some items to 0 and use the “Display: Hidden” feature to hide some content From victims. They also insert zero-width (ZWSP) and zero-width non-joiner (Zwnj) characters and ultimately hides the true email content by embedding irrelevant language.
As a result, E -mail security solutions, SPAM filters and brand name extractors are confused, and the e emails that would otherwise end in the spam folder make it directly to the inbox.
Advanced filtration
In its writing, Cisco Talos has given several examples, including one where attackers hid French words IE mail’s body. This confused Microsoft’s Exchange Online Protection (EOP) spam filter, which ultimately lets the message pass.
In another example, Cisco Talos said threat actors used CSS properties and ZWSP characters to hide E -Mail content, successfully mimic Wells Fargo and Norton Lifelock.
To tackle this strategy, the researchers suggested that the team adopt advanced filtration techniques that scan the structure of HTML -E emails, rather than just their content. Thus, an E -Mail security solution could look for extreme use of inline styles or CSS properties as “visibility: hidden”. It is also recommended to implement AI-driven defense.
E-mail is still one of the best attack vectors because of its simplicity, ubiquitous and low cost of a large-scale operation. It also owes its popularity that it attacks E -mail security chain on its weakest link -the human.
