[XIan]

Hey guys, I've always heard the age old "don't click on links in emails" and can understand the dangers in doing so to some extent but Im wondering what the major downfalls could be, if someone had malicious enough intent?

So far, I understand most malicious emails sent to schools / businesses are phishing, and simply clicking on that won't do terribly much unless the user physically enters information in. Now, what else? We could have XSS, CSRF, DNS Rebinding, etc. but most of these are being mitigated by browsers themselves. What else can happen if you were to click a malicious link nowadays?

Thanks guys!

[Cr3aTor]

So far, I understand most malicious emails sent to schools / businesses are phishing, and simply clicking on that won't do terribly much unless the user physically enters information in. Now, what else?

While this is true, there have been in the past malicious users who where able to download and even run the malicious file.

We could have XSS, CSRF, DNS Rebinding, etc. but most of these are being mitigated by browsers themselves.

I won't argue that there are mitigations against these kind of attacks implemented in the browsers, but again it only takes a single mistake to be made by the teams who develop such mitigations for an attacker to find a bypass to it. Therefore we've seen a lot of examples in the past of such mechanisms. After all it's a cat and mouse game.

What else can happen if you were to click a malicious link nowadays?

I will not take in consideration any 0-day vulnerability in here, but a malicious user could pretty easily gain a lot of information about your machine, redirect you to carefully crafted phishing websites and deceive you, run javascript of any shape, thus can see what other tabs you have opened, etc.

There are a lot of things you can do just by deceiving a user to enter your website and it's a subject with a pretty big amplitude if you ask me. After all the only limitation is the persistence, experience and the creativity of the attacker.

[darkninja1980]

Well, I can say only download a file from someone that you trust.

[mothered]

We could have XSS, CSRF, DNS Rebinding, etc

You've answered your own question.

but most of these are being mitigated by browsers themselves.

Do not expect browsers, AVs, IDS/IPS and the like, to take care of such threats In It's entirety.

They cannot possibly account for every malicious entity online.

[XIan]

We could have XSS, CSRF, DNS Rebinding, etc

You've answered your own question.

but most of these are being mitigated by browsers themselves.

Do not expect browsers, AVs, IDS/IPS and the like, to take care of such threats In It's entirety.

They cannot possibly account for every malicious entity online.

True, I just didn't know if there were any larger things that I was missing out on that people are vulnerable to. Also, I didn't know the full scope of mitigation by browsers so I appreciate you putting it into perspective for me! Thanks

[bender]

Several types of dangers hidden file trojan virus .exe link that retrieves your ip or information about your location

[Duo Duo]

Hey guys, I've always heard the age old "don't click on links in emails" and can understand the dangers in doing so to some extent but Im wondering what the major downfalls could be, if someone had malicious enough intent?

So far, I understand most malicious emails sent to schools / businesses are phishing, and simply clicking on that won't do terribly much unless the user physically enters information in. Now, what else? We could have XSS, CSRF, DNS Rebinding, etc. but most of these are being mitigated by browsers themselves. What else can happen if you were to click a malicious link nowadays?

Thanks guys!

西安的？同一座城市

[taylostolo]

Hey guys, I've always heard the age old "don't click on links in emails" and can understand the dangers in doing so to some extent but Im wondering what the major downfalls could be, if someone had malicious enough intent?

So far, I understand most malicious emails sent to schools / businesses are phishing, and simply clicking on that won't do terribly much unless the user physically enters information in. Now, what else? We could have XSS, CSRF, DNS Rebinding, etc. but most of these are being mitigated by browsers themselves. What else can happen if you were to click a malicious link nowadays?

Thanks guys!

Want me to show you i have wanted to blow up someones computer recently