Final Destination Determination Process for Phishing Link Bypass
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current security measures, such as blacklists, sender display, and link scanning, are ineffective against phishing attacks as hackers can easily circumvent these methods by creating dynamic links that behave differently for security services and user devices, allowing them to redirect users to malicious sites.
Innovation Solution
Implementing a final-destination determination process (FDDP) that identifies and displays the ultimate destination of a link, allowing users to connect directly to it, thereby bypassing all intermediate URLs, thus preventing hackers from exploiting link redirects.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If link scanning is used to detect malicious sites, then security detection capability is improved, but hackers can easily circumvent it by creating dynamic links that behave differently for security services and user devices
Solution Approach 1:
Instead of having the user's device follow redirects and then scanning the final destination, the system inverts the approach by scanning the link behavior from the security service's perspective first. The FDDP determines what the final destination would be for a security service, and then the user's device connects directly to that determined destination, bypassing the redirect chain entirely. This inversion makes dynamic link behavior ineffective because the destination is predetermined and static.
Solution Approach 2:
The system performs preliminary action by determining the final destination (FDDP) before the user's device actually connects. The security service scans the link and identifies where it would ultimately redirect to, then this information is used to establish a direct connection path. This preliminary determination eliminates the need for the user's device to traverse the redirect chain, preventing hackers from changing behavior based on device characteristics.
2Ease of operation
If user devices follow link redirects to reach destinations, then link functionality is preserved, but users can be redirected to malicious sites by phishing attacks
Solution Approach 1:
The system extracts the redirect-following functionality from the user's device and relocates it to the security service. The FDDP process determines the final destination by following redirects on behalf of the user's device, then the user's device connects directly to that destination without ever following the redirect chain. This extraction preserves link functionality while eliminating the vulnerability to phishing attacks.
Solution Approach 2:
The system introduces an intermediary (the FDDP process running on the security service) between the user's device and the link destination. This intermediary determines the final destination by analyzing the redirect chain, then enables direct connection. The intermediary protects the user's device from encountering malicious redirects while maintaining the intended link functionality.
3Reliability
If blacklists are used to block known malicious sites, then protection against known threats is improved, but hackers can easily create new phishing sites that bypass the blacklist
Solution Approach 1:
The system performs preliminary action by determining the final destination of links before users interact with them. The FDDP process scans and identifies where links would ultimately redirect to, allowing the system to block malicious destinations proactively. This preliminary determination occurs regardless of whether the destination is known or unknown, eliminating the time lag associated with blacklist updates.
Solution Approach 2:
The system changes the parameter being monitored from static blacklist entries to dynamic final destination determination. Instead of relying on precompiled lists of known malicious sites, the FDDP process evaluates each link's actual behavior and determines its final destination in real-time. This parameter change allows the system to adapt to new phishing sites immediately without waiting for blacklist updates.
Data Source
AI summary
A system and method is described for protecting applications against malicious URL links by identifying a final destination. The system and method also includes enabling a user process to directly connect to the final destination, bypassing the original URL altogether; thereby bypassing the hacker's ability to use that URL to programmatically send the application to a malicious site.