Could embedding website links in an email lead to more hack attempts?

Question

My organization currently sends out emails directing our customers to login and view information on a customer portal site we have developed. The content of these emails is usually pretty generic since we prefer to send all confidential information to our customers through this secure website.

I have recently been asked if we should eliminate all URLs that link to our customer portal from the emails that we send out. The justification for this request is to deter attempts to hack our customer portal. Since this request came from executives and not security experts I would like your opinions. Would this in any way decrease our chances of our customer portal being attacked?

One more piece of potentially useful information is that a link to this customer portal is published at the bottom of our public website.

Answer 1

Unless you are sending specific strings in the URL to provide pass-throughs (where a user can click to log in without authenticating) there is no more danger with out without links. The reasoning for this is, someone can stumble unto your portal as it stands (provided it is on the public Internet which it would have to be unless you established some form of SSLVPN/VPN connection to an intranet).

If your goal is to provide an exclusive connection point to a specific site intended ONLY for ONE specific client, you could create a firewall rule that explicitly allows connection from your client's netblock to that site. This ensures no one but the client from the location specified can connect.

Now you state: "a link to this customer portal is published at the bottom of our public website" so there is no more or less danger than sending it in an email. So if your goal is to minimize who can access this portal, it may be a better approach to determine where your client's connections are coming from, make a firewall rule to allow those, and deny everything else.

Answer 2

I see at least one way an attacker can take advantage of these e-mails. The attacker (perhaps one of your customers) might attempt to "claim to be you" and send an e-mail to your customers with a very similar link, to a faked version of your website. When the victim user "logs in" to the faked site, the attacker would then have their username and password, and could then log in as the victim user on the real site.

Answer 3

This is Security through obscurity and it appears to be being used as a measure in lieu of properly securing the customer portal.

There is an advantage of never sending links in emails though, as this could reduce phishing attacks on your customers. However, customers must already know that you never send links via email as an attacker sending a phishing email would include the links and await someone to blindly follow them which. Someone might eventually, depending on the size of your customer base and if the attacker managed to create a properly targeted phishing campaign (for example, through the use of a User Enumeration vulnerability on your customer portal or elsewhere).

Not mentioning the portal in email does not mean that its existence would not be determined by any attacker. There are many reconnaissance techniques ranging from DNS enumeration, search engine results, whois information, background check services, public company information, Google Hacking, Netcraft, etc, that attackers can use to gain information on a company and which sites they are running.