2

People using outlook.com as their mailbox may know this: If you receive an e-mail with a web link in it and copy the link with "right-click + copy link location" you will receive an outlook protection link. For example "https://test.com", will become this protection link (in my case):

"https://eur01.safelinks.protection.outlook.com/?url=https%3A%2F%2Ftest.com&data=02%7C01%7C%7Ccb2efbed1ae44d545cac08d644e7b37d%7C84df9e7fe9f640afb435aaaaaaaaaaaa%7C1%7C0%7C636772159263508835&sdata=8BK6la8r8jweL6T0bH9cm7VNzh5IIrx7hVL0ASZc6GU%3D&reserved=0".

This is some sort of protection, but I cannot see what attack it is preventing. Does anyone know for what this "link wrapping" is? I also wonder, what the data and sdata parameters are. (Seem to be hashes? [of the website?])

closed as off-topic by schroeder Nov 7 '18 at 20:01

This question appears to be off-topic. The users who voted to close gave this specific reason:

  • "This question does not appear to be about Information security within the scope defined in the help center." – schroeder
If this question can be reworded to fit the rules in the help center, please edit the question.

  • Not everyone gets safe links (I do not). Advanced Threat Protection needs to be enabled for people to see this. Also, you do not need to copy the link, if you hover over it, you will see the safelink, too. – schroeder Nov 7 '18 at 19:50
  • Microsoft explains safelinks in their help. – schroeder Nov 7 '18 at 19:52
  • @schroeder can you provide a link to this help page? I cannot find it (I wouldn't have asked it here if I'd found it) – Amon Bune Nov 7 '18 at 19:54
  • I Googled "outlook safelinks" ... support.office.com/en-us/article/… – schroeder Nov 7 '18 at 19:54
  • Seems like I have to switch search engines. – Amon Bune Nov 7 '18 at 19:59
0

Safe Links is a feature that originated in Office 365 Exchange Online Advanced Threat Protection. https://products.office.com/en-us/exchange/online-email-threat-protection

By wrapping the link, you give Microsoft a chance to check the URL before letting you through. So if it is say a link to download a virus or malware, it can show you a block page or warning page instead. The service also do some advanced stuff like visit the page on your behalf and scan for threats just in time, or show you the destination in a sandboxed page to prevent malware.

This is better than scanning the email at delivery time because some links may be to phishing sites or zero day malware that has not yet been discovered. But by the time you click the message in your inbox, it may have been caught (and thus will be blocked).

In a corporate environment, this is also helpful because it allows you to get metrics on who clicked on what. If an employee clicked through to a phishing site, you can look at the logs to determine who also clicked on that link as take action.

Not the answer you're looking for? Browse other questions tagged or ask your own question.