76

Everyone knows of the common cybersecurity tips to be careful when you open links in an email. But every day we look for something on the Internet, clicking links which the search engine shows us, and we do not have the same fear. Why are the links in email considered more dangerous than links from web search results?

Maybe it is related to the fact that links in an email may contain a more personal attack malicious to you or your company?

9
  • 3
    I've watched people click through nothing but ad links and banners until they got to their intended destination because every click kept sending them to the wrong site. They eventually got to their intended Adobe Reader download but whether this was safer is up for debate.
    – MonkeyZeus
    Nov 23 '20 at 14:22
  • 1
    Safer doesn't mean safe. I got a virus once while googling how to do REGEX ... Search engines do tend to prune their results but nothing is guaranteed safe.
    – aslum
    Nov 23 '20 at 16:06
  • 11
    @aslum, I'll email you some links for how to regex.
    – Michael
    Nov 23 '20 at 16:33
  • 3
    @Michael Yeah, that'd be great, could you mail them to me five years ago please?
    – aslum
    Nov 23 '20 at 16:34
  • 2
    @AaronF It's been a while, but the site itself started cascading popups and trying to install software. I unplugged the cat5, closed everything, and was able to clean it before any damage was done, but technically I did get a virus for like 30 minutes.
    – aslum
    Nov 23 '20 at 23:20

13 Answers 13

101

The results of a search engine are based on previously collected data, i.e. the engine does not starts to scanning the whole internet when doing a search but it looks through an index of seen and stored sites. The results are also ordered, i.e. the sites which fit the query best and which also have the highest reputation for good answers in general are at the top. Thus, as long as fairly common search terms are used the top hits come from sites with a high reputation.

There are attempts to pollute search engines by returning different results to the search engines web bot than to the normal user. This is not new, so search engines partially try to detect such pollution by simulating normal users. They also include historic reputation information, i.e. sites which behaved shady in the past are considered shady for some time in the future too. New sites also have less reputation than established sites etc.

This together makes search engines results fairly good (but not perfect) curated data. Links in mails are the opposite of this: No up-front checks and curation are done to these links and it is all to the end user (or some security software in the path) to decide if this link is safe or not. That's why these links are far more dangerous.

6
  • 7
    Good answer. Another point is that links in search engines are usually displayed openly before you click (you can see the actual URL, at least the domain) whereas links in emails (especially phishing emails) are more commonly hidden by alt-text or images. You have to hover over them for a tooltip or check the code to see the actual URL, which the common user might not stop to do. That's not to say search engine results can't be misleading, but more transparency is always a good thing.
    – Steve-O
    Nov 23 '20 at 15:49
  • Spam protection can perform similar checks on the sender and the link (at least the domain of the link, that is), although at the end of the day it's still going to be "in private", which allows for only so much protection (and at some point that arguably starts coming at the cost of privacy), and it's thus indeed "far more dangerous".
    – NotThatGuy
    Nov 23 '20 at 18:41
  • 2
    @Steve-O assuming you haven't disabled HTML display in mails. Which I'd recommend if you feel security conscious. Imho there is nothing written in a mail that needs HTML to bring its message across. Granted some mails look nicer that way (though personally to me most such html mails just make it harder to get at the gist of things). But valid point nonetheless. With that comes a comparable format, i.e. it looks the same for any page and you know how to look for the clues without having to deal with any trickery or mail client specifics. Nov 23 '20 at 21:16
  • 2
    @FrankHopkins Links in emails may be behind URL shorteners, too, in which case looking at the actual URL won't help. Search results usually don't use those. Nov 24 '20 at 14:17
  • So, to sum up your answer, because someone should decide if a link is safe or not, either at the very end, or while storing, processing, delivering and displaying it to the end user. How can someone decide once the decision was already made by those who constructed the link?! That the intermediate or end user does not know the choice made does not change the situation at all. What is really dangerous is to believe that someone can decide something for others because this means the need for someone who others can just believe and ignore their own responsibility for their choice.
    – Aleksey F.
    Dec 4 '20 at 17:32
86

Let me use an analogy:

It's for the same reason we tell our children not to take sweets from strangers, but at the same time we allow them to buy some in the supermarket with their pocket money.

Or more technically: The difference is that in the first case you receive something you did (likely) not ask for, in the second case you yourself look out for something you need.

Or, in the form of an advice: Never accept something given to you without having asked for.

8
  • 6
    @gerrit The "no sweets from strangers" rule is itself a strawman. But that's what you get for lying to children! We could just tell them that most strangers are probably no danger at all to them, but that you just can't tell, and we thus want them to not accept anything from anyone they don't know though us. (Which is stupid, too, as most cases of child abuse are committed by exactly those people our children know through us, if not by ourselves...) Nov 24 '20 at 8:39
  • 4
    @Clonkex I feel like that is not fair treatment for haloween. Of course, you are free to hate haloween that's personal opinion, but I cannot agree that this is a valid reason. There is a big difference between wandering the street at night all alone and wandering the street at night with a few friends while many other groups of kids are doing the same, some of those groups even with parental supervision. It's the same difference between walking down mainstreet and walking down a small alley in a place you've never been before.
    – Poseidaan
    Nov 24 '20 at 11:20
  • 1
    @gerrit Well, these children ASK for it, and at least in my region, the children also go around their own neighbourhood mostly, so the analogy would still hold up to a degree.
    – Marcel
    Nov 24 '20 at 12:45
  • 2
    To my knowledge, there is only one verified case where an adult was giving out tainted candy on Halloween, and even then it was unintentional. Mind you, typically everyone cooperates to favor candy that is individually wrapped.
    – Brian
    Nov 24 '20 at 15:01
  • 4
    I'm not sure you trust the supermarket because you're paying (free samples are fine). Its because the supermarket is a known organisation with a reputation to lose if it acts badly. Just like google; if google started scamming people it would be a huge reputational hit. While for a person sending you an email they are an unknown person with nothing to lose by scamming you. Nov 24 '20 at 15:42
32

One reason might be that links in emails can be "personalized", links in web searches can not. A common tactic that spammers use is to send out links containing some token representing your email address. This can be as simple as:

http://totallylegit.domain/?mail=your.email@address.tld

but can also be hidden in various ways (by assigning some pseudo-random identifier to each email, and including a hex/base64/... string or even a series of words representing it).

The idea is that the spammer is able to learn who clicks the links in their emails, meaning that

  • this address actually exists and is accessed by a human* and
  • the person is more likely susceptible to spam, because they actually clicked the link

This is of course more an annoyance than a direct threat: You will simply get more spam mail. Although theoretically they might also be able to learn about things like the used browser and OS (from your browsers UserAgent) and use that to send more specific phishing mails in the future.

Also, this personalization might make the link itself more "dangerous". Imagine you open a link, forget about it, and later return to the tab. That tab now shows a Google log in page. You might be less suspicious if this log-in page already shows your correct email address entered. This doesn't just apply to the email address itself: Maybe the spammer (automatically) guessed your name or your company from the email, or found further information about you in a data leak, or maybe they sent mails linking to a fake corporate login page only to people from your company in the first place. The more information about you someone has, the more likely it is that he can make you enter a password or download some malware.


*By the way, this can also occur when the mail client is configured to automatically download and show images embedded in the email: This can immediately tell a spammer that the email was opened, even before any link is clicked.

14
  • 8
    Also, search engines generally will be more transparent about the actual target of the link. In an email, a scammer could try to obfuscate the link's real destination. Maybe the link title says accounts.google.com, but the real target is accounts.google-qZyW7b.com, i.e. a phishing page. Nov 22 '20 at 15:05
  • 13
    Note that Google does use personalized links in web search results, and uses them to track you. See chrome.google.com/webstore/detail/google-search-link-fix/… to avoid it. Nov 22 '20 at 20:21
  • 9
    @ManfP Unless you consider Google a malicious actor in its pervasive tracking. It checks all the boxes in your answer. Nov 23 '20 at 7:42
  • 2
    @ManfP So "a spammer gets to know if I clicked on a link, and will use this information to send me ads" is considered a security threat, but "Google gets to know if I clicked on a link, and will use this information to send me ads" is a privacy problem in a different category and is not relevant here? Nov 23 '20 at 14:05
  • 2
    @FedericoPoloni OP was specifically asking about the dangers of visiting a website from a search engine vs mail, not about the dangers of using a search engine by itself. Also, the "ads" in the first case are pretty likely to be phishing attempts or malware downloads, which fits with a much more immediate understanding of the word "dangerous".
    – ManfP
    Nov 23 '20 at 14:33
13

You asked:

Why is a link in an email more dangerous than a link from a web search?

Respectfully, I think you asked the wrong question. I think a better question would be

Why does cyber security training focus on email links rather than for example links from a web search?

Because, according to Verizon, who does extensive analysis of breach incidents in their annual 2020 Data Breach Investigations Report:

90% of malware comes from emails (Verizon).

(citing a different page since the Verizon report is paywalled)


There certainly are attacks that start by clicking links in search engines. I helped clean up one incident where someone googled for the customer support number for their laptop manufacturer; the top sponsored link (ad) was actually a malware company that guided her to download and run their malware as part of the "tech support call".


I think search engine links can be just as dangerous as email links, they are just a lot less common for a breach to start with a search engine link.

7

Search engine finds are not completely harmless, however!

We once had to fight a virus downloaded from a top-ranking search result for a somewhat specific but legitimate topic. The user did not notice (or even could notice) that their German search result was on an otherwise English-speaking website hosted in Indonesia. I found out only because I noticed a non-https http request to a wordpress page with unusual in the proxy logs around the time of suspected infection. At that moment, the page was already offline, but searching for all search results with that site revealed lots of somewhat similar finds (but all unrelated to the site's natural topic) highly ranked by the search engine.

Apparently, they managed to hack a wordpress site, spam search terms, get high rank for these, and then switch to malicious content ...

6

There are some inherent limitations in email which make it particularly difficult to determine authenticity of any communication, and as a result it has been really difficult to stamp out or control certain bad behaviour in that medium.

The issue is that if you have an email account, you are implicitly allowing anyone in the world to send email to you, rather than only people or companies you know and trust. And, when email arrives that appears to be from a person or organization you know, there is a lack of reliable ability to know for sure if the email really did come from that organization of if it's a complete fake, and part of a scam.

Over the years there have been a number of extensions to email that attempt to solve this problem, but all with flaws. Unlike with the web, efforts to secure DNS do not help email, as email is not tied to a hostname in a way that the user can easily see and verify. The best yet solution to the problem is DMARC, which allows verifying that the sender was authorized to use the hostname part of the from address. But, the slow adoption of this standard hinders its overall reliability, and usability-wise it comes nowhere close to the simplicity and effectiveness of the "padlock icon" in the location bar of a web browser.

All of this sum up to the fact that you should think twice about trusting anything in an email that arrives unsolicited (as tends to be the case for email). In particular, links give an untrusted party a lot of leeway to trick you in novel ways either by taking you to fake (phishing) sites or to real sites, to trick you into taking certain actions that may benefit the scammer. It just lets you go further into the world of the scammer.

To compare this with arriving at a website via a search engine: the way you got to the search engine in the first place probably ensured you were at the genuine search engine's site, either by building the search engine into the browser or using a known bookmark or even a known web address of the search engine. Major search engines go to great lengths to try and prevent phishing sites making it into results as do major web browsers, but on the off chance someone does manage to trick the search engine and you end up on a non-trustworthy site that isn't picked up by your web browser, users are arguably more familiar with the usual ways of knowing if a website is genuine: the padlock and the address "looking right", and so on. It's not out of the question that this fails, but the nature of it is very different to email, where the scammer directly contacts you and you don't go through those other steps.

5

I disagree with the concept present in other answers that search engines provide "curated" data that would be "safe". I however concede they have a point in that web search links:

  • Are ranked, and the user will barely pass the first few results. Reputation of top results (accrued through time) is probably orders of magnitude bigger than most phishing pages (which are shortly lived).
  • I expect <phishing inbox mails> / <total mail> will be higher than <phishing results> / <total indexed results> for most searches. (Proper) Web result sorting will make much more hard that it is clicked (a wrong sorting that put the phishing on the top would be really harmful, though), whereas likelihood of reaching the malicious link (prior to opening/filling the phishing form) will probably be equiprobable to the proportion of email in the INBOX/Spam folder (depending where it ends up) that the user reads. Up to 100% of being found by the user.
  • Search engines can dynamically remove search results. If they had a result for the user query that would have been shown, but it is now on a blacklist [they pay attention to], or simply they received enough user feedback to reconsider it, they can skip it on future searches of that term. While email providers do sometimes move to spam folder emails that had already been delivered into the inbox, if they were not seen by the user (and some companies even completely remove already received phishing mails from user mailboxes) generally, once delivered, the mail stays there, with the classification it got at time of reception.

However, I don't think those would be as important as the context in which they are framed.

First of all, I'm not completely sold that an email link is more dangerous than a web search one. This would probably be interesting for a study. Ultimately, the one that ends up affecting you is the one that was most dangerous for you (this time). You need to keep an eye on all fronts.

Why do I talk about the contexts of links coming from emails vs web searches? Typical fraudulent emails have lures such as:

  • New invoice
  • Your mailbox is full
  • Protected email
  • Hello adamshakhabov5
  • Bank account blocked

Phishing links flourish here, since receiving an email link from which you need to authenticate is a normal action. You need to enter your credentials to access your mail, your bank could send you notices by email (at least it would be conceivable that it did), and even the weird phishing pages where you need to log in with any email account to "download" the document have a fraction of plausibility (if you ignore their many telltale signs). on the the other hand, when were you last asked to provide your credentials (legitimately or not) as a result of a web search? It should raise much more suspicion.¹ They have no rationale to need your email password.

For malicious web search results or advertisements, you will mostly find things like fraudulent shops selling counterfeit goods. That's a model that fits much better the profile of a web search: the user wants <product> and gets to a web page claiming to sell it with a 80% discount ('surprisingly' they charge a different amount than advertised, the product is different to what was expected, it directly never arrives...).

Maybe it is related to the fact that links in an email may contain a more personal attack malicious to you or your company?

It depends. For instance, some companies would worried about attacks directed at them but not concerned about other malicious links not affecting them. An employee sharing their credentials to the company could lead to a leak of confidential data, access by an attacker to their systems, etc. but not consider an issue that an employee lost some money by buying a pair of fake shoes (in fact, they probably shouldn't have been buying shoes on company time).

Email would be an obvious point of entry for an attacker that tried to penetrate the company IT security, whereas getting their search engine results to lead to them would be harder, and it may be expected that you would have to be either the search engine or the ISP (not that you couldn't indirectly target specific people, though)

I would be wary of approaches that focused on specific threats and then neglected compromise sources not typically used by actors you are concerned about, though. Nowadays, nobody can be considered safe thinking they will be ignored. They will be compromised first, then sold to someone willing to pay for access to that company, not the other way around (while such focused targeting might still happen in some cases).

¹ Interestingly, this could change if "log in with Facebook/Google" options were much more widespread.

2
  • 1
    I think this covers the situation pretty well. In particular, it's a lot easier to fool someone into giving details from an email purporting to be from an organisation they recognise as having already signed up to, compared to relying on them stumbling on your website and then willingly entering their details. Of course, links on web searches will have other methods (such as malicious ads concealed as download links for a file you're looking for), but I notice that folk tend to be more vigilant when navigating sites they're unfamiliar with than they are scrolling through their mail inbox. Nov 24 '20 at 11:38
  • 1
    "when were you last asked to provide your credentials (legitimately or not) as a result of a web search?" -- A subset of people actually use search engines instead of bookmarks. So for those people, they would expect to type the name of, for example, their ISP, click the top result, and then enter their ISP username/password in the login on the main page in order to see their account. I think this is actually becoming more common, since mobile bookmarks are awful and search engines are fast. Nov 24 '20 at 13:41
3

First of all the email links are shared with you, so most probably you will notice them whereas web search links are not shared with you; they are on the web and come to you as a search result. Most likely you won't even notice all of them (when you search something on Google, you don't click each and every website that shows up in results; you click only the site that you want. You will scroll past all the other results.)

You have added "social engineering as a tag. If you know SET (Social Engineering Toolkit), it is an application that has many attack options and most of them require an email to send.

These are some really big reasons that prove why email links are more dangerous than web search links.

I found a site which you can read for more info

3
  • 1
    why are you shouting?
    – schroeder
    Nov 23 '20 at 10:18
  • @schroeder I am not shouting.I am just helping him and you cant say if someone is shouting or not by just a text.
    – Sodead
    Nov 26 '20 at 7:02
  • When you use all caps in your text, it's typically perceived as "shouting". And yes, I can say that you used an excessive amount of all caps with just text. When posting here, please do not use all caps or excessive formatting. If you highlight everything in a post, you highlight nothing.
    – schroeder
    Nov 26 '20 at 7:37
3

One additional reason, not mentioned in other answers (it seems) is that search engines will not render deceiving attacker controlled html code (they prefer to do the deceiving themself), therefore the target domain and rest of the URL can usually not be obfuscated like you can do it in a hand crafted HTML where the text is using for example JavaScript or large username@ hacks to confuse people hovering over the link.

Also if a phishing attack is detected search engines are quicker to blacklist or demote the offending search results, so it is very unlikely the attack persists for long.

But of course, using your own bookmarks or typing in the wanted target is safer than any of the both other ways. (Or at least only clicking on links in expected emails).

Having said that, most of the time clicking on a dangerous link should not compromise you, real drive by downloads or browser exploits are seldom and should be avoided by software. (Which does not mean you should not avoid them anyway). What’s really critical is signing in or sending sensitive forms to unexpected peers. Here it helps if your password manager actually verifies the input field origin domain

1

That's a good question and you're on the right track doubting that the search engine result is more secure.

What could make a search engine result secure?

  • Hoping that dangerous links have bad ranking
  • Hoping that search engines use blacklists
  • You are choosing your search terms, the attacker does not know them

What could make an e-mail dangerous?

  • A spam filter (and its blacklists) do not recognize the e-mail / link in the e-mail
  • You may be targeted, as an attacker may explicitely choose your e-mail address
  • You do not have to take action (like searching for something) but get a prompt to do something in your inbox

But what, if a bad link has good SEO, is not on a blacklist and the page optimizes for common search terms? Then you have absolutely the same problem.

Try to search for some Windows system file names. You will probably get a lot of "Fix freezes caused by explorer.exe" pages, which want you to download their special anti-virus program. That is malware (or at least deceptive software that wants to make you pay) with good SEO optimized for a certain target group, i.e., people trying to find solutions for Windows problems.

So your search results may be safer when the search engine does good filtering for your usual search terms and your inbox may be safer when your spam filter is very good (or your e-mail address is hard to guess and only known to trusted people).

A general statement "search result links are safe(er)" is not possible.

-4

I think the main difference is that a link in an email can be tracked to your actual email address. So the attacker can collect informations about your system like "language, os version, ip-address" e.g. and link this informations to an email account. This doesnt mean that this informations are not retrievable on a normal weblink, but the allocation to an email address would be missing. So the attaker is able to create a profile and hast the option to send a second email. On normal weblinks the chance of having an option of recontacting is very low.

3
  • 2
    Why is the linkage of the web browser info to the email address dangerous?
    – schroeder
    Nov 24 '20 at 13:28
  • Hi @schroeder because if you click on the link on an email, the attacker knows that you click on links in emails. And will send you more emails. When clicking on an link in the web, it is just an anonymous person that clicked the link. Nov 25 '20 at 17:25
  • Can you add that to your answer?
    – schroeder
    Nov 25 '20 at 19:52
-4

The primary reason is this, SSL/TLS authenticates the domain name, and you use an encrypted protocol. This means eavesdroppers can't decrypt the message or alter it. So you can trust the domain names most times assuming they are legitimate and not malware sites.

Email however it is possible for people to send an email claiming to be from anyone they want. They won't be able to receive further replies from you as the address they claim will receive them however, it doesn't matter. They can put any URL in the hypertext link, leading often to a fake site etc.

The key difference is, you trust your browser, it then connects you to the actual domain name you requested, on a secure line. If you trust the actual site, you know that is who it really is. Email, you would actually have to look at the URL, and anyone can spoof an email as from someone else. Nobody as of today can spoof a domain name TCP connection with SSL/TLS enabled. This means a server certificate, which authenticates the server is who they say they are.

5
  • 1
    Several incorrect statements here and some assumptions. With Let's Encrypt, a malicious site can use TLS for free. The danger of the link remains. SPF/DKIM/DMARC means that you can verify the sender. You can easily change the email alias and reply-to so that you can receive the replies. Email clients also use technology to connect you with the trusted sender of an email. TLS breaking allows people to spoof TLS connections. That's how corporate proxies work.
    – schroeder
    Nov 24 '20 at 13:31
  • 1
    This also doesn't answer the question about the link. Your focus is on validating the sender of the email.
    – schroeder
    Nov 24 '20 at 13:33
  • It does not remain, I've personally written tls implementation on win soc, it's on my GitHub under same s.n. Most tls cipher suits use a server side certificate scheme. That means your browser can verify the html, or anything above tcp, and tls, has not been tampered and is private. There for the trust of a hyper link is entirely in the web browser, and the domain name you are accessing. So if there was a ... Malicious hyperlink, the domain names web server gave it to you. Nov 24 '20 at 19:06
  • For example if I access google, I can chain trust of all hyperlinks to googles servers. A malicious attack would have to target the domain names web server. No issue for transmission, further its unrelated question you raise asnto the theoretical vulnerability in tls. I can say this I have a b.s. In math, I understand rsa and elliptical curve, I put my trust in it. An email link, HA. Nov 24 '20 at 19:10
  • Additionally sql was often where hyperlinks stored, and sql injections were a thing, so you may remember sometimes links would get hacked. To anyone genuinely out there who actually takes interest in these things. Nov 24 '20 at 19:20
-5

Links on a website are located a remote server, "sandboxed"* inside a web browser.

Links in an email are located on the local machine.

*I say sandboxed here, not to imply they exist in an environment that's 100% isolated from the local machine, but to imply that web browsers generally have some characteristics that create impediments for malware to infect machines, locally.

For instance, most browsers treat any link that downloads a file with some sort of caution. These impediments range from a simple message box warning the user, to outright refusing to download the file at all.

Another characteristic of browsers is that code is usually run on the server side, not the client side. Take Google Sheets or MS Excel on Office.com. When a cell's formula is calculated, that is being done "in the cloud", not locally. When you enter a formula and press enter, the browser updates the SERVER and the server calculates the cell and then displays the result. At no time does the browser use the cores on the local machine to process the calculations.

Obviously, browsers are much more capable of doing things "client side" than they once were. But HTML, PHP, CSS, javascript, SQL...these are basically scripts, they are not true code, such as that can modify a local registry. To infect a local machine from within a browser, a piece of code must usually hijack a benign process. The ability to create an HTTP link that does this requires a decent amount of knowledge about malware and exploits, etc.

On the flip side, a local email client sits inside the local OS environment, which has access to the kernel. Any malware process originating from within the email client is starting out as a local process. The only thing protecting you at this point is whatever security your OS inherently provides (UAC, process isolation, etc) plus any add-on security app that may be running in the background.

3
  • Just about every statement you make is incorrect and the things you try to differentiate email. clients from browsers are not actually any different. When you click on a link in an email, it's passed to a browser...
    – schroeder
    Nov 24 '20 at 20:35
  • And here's a fun test: open Google sheets, turn off your wifi, and keep using the sheet and enter new formulas. You will find that you can. That's all provided client-side via javascript.
    – schroeder
    Nov 24 '20 at 20:41
  • HTML and CSS are not scripts. PHP and SQL run server-side, not client-side. Javascript can indeed modify the Windows registry (there's even a library from Microsoft to do it). And there are quite a number of powerful javascript malware out there that doesn't need to hijack another process.
    – schroeder
    Nov 24 '20 at 21:21

Not the answer you're looking for? Browse other questions tagged or ask your own question.