Re: HXXP browser protocol

2012-09-13 Thread Sean Harlow
Fur further reference, wiki gives the following reasons for hxxp or other similar methods of URL obfuscation: Some of the uses of this method include: * to avoid passing the HTTP referrer header which would reveal the referring web site to the target. * avoiding automated web crawlers from follo

Re: HXXP browser protocol

2012-09-13 Thread Sean Harlow
On Sep 13, 2012, at 17:21, Landon Stewart wrote: > All true and commonly used but it's worth mentioning that putting a space > before the dot TLD is a better way to prevent auto linking in email/IM > clients since most of them detect the formation URLs by other means rather > than rely on the e

Re: HXXP browser protocol

2012-09-13 Thread Landon Stewart
On 13 September 2012 09:38, Sean Harlow wrote: > Using "hxxp" is a common method to prevent auto-linking by various > email/IM clients and/or forum software to then require the user to actively > copy/paste the URL to get the content. > > In the case of a security alert, I could see it being used

Re: HXXP browser protocol

2012-09-13 Thread Ricky Beam
The reason I ask is that we received a security alert with a link hxxp://pastebin.com/###. hxxp has been around for a long time. It's a lame hack that was never widely accepted by browsers. The purpose was to have a clickable link that didn't send a referer. (i.e. copy-n-paste) There was

Re: HXXP browser protocol

2012-09-13 Thread Sean Harlow
On Sep 13, 2012, at 12:34, Matthew Black wrote: > Checking if anyone else has heard of this protocol. It seems to be a method > of bypassing security filtering software. > > The reason I ask is that we received a security alert with a link > hxxp://pastebin.com/###. > > Seems very suspicious a

HXXP browser protocol

2012-09-13 Thread Matthew Black
Checking if anyone else has heard of this protocol. It seems to be a method of bypassing security filtering software. The reason I ask is that we received a security alert with a link hxxp://pastebin.com/###. Seems very suspicious and want to know if anyone can shed light. Is this a new phishi