Stop Phishing by Analyzing the Bait
Tags: cybersecurity, phishing, browserextension
Published: 2024-07-12 21:10:44

---
title: Stop Phishing by Analyzing the Bait
published: true
description: Phishing is a cybersecurity threat that relies on human error or trust.  It's a social engineering attack intent on obtaining information by getting a user to open an email or click on a link.  Can I build a tool that could help users to know something about a link before they click on it?  
tags: cybersecurity, phishing, browserextension
cover_image: https://res.cloudinary.com/picturecloud7/image/upload/c_pad,h_420,w_1000,b_auto/no-fishing-allowed_w1ikle.jpg
# Use a ratio of 100:42 for best results.
# published_at: 2024-07-08 23:32 +0000
---

CyberSecurityNews.com published a gif on X showing [Top 8 Cyber Attacks 2024](https://x.com/The_Cyber_News/status/1769244926984765858) last spring that shows the top 8 cybersecurity threats for 2024.  This chart has popped up in many places.  I like the way it's paired with Beethoven's Moonlight Sonata here:

{% embed https://youtu.be/aVPfexDpikM?si=ilOytMBbtNXxKWhg %}

I've worked on product releases where we just scoured the front end to try to eliminate any HTML that might lead to a security issue

If you look closely at the list 3 out 8 of these attacks rely on front end software, that is, a vulnerability in the browser.  Fullstack application developers can use this awareness to help prevent these problems.  The list of attacks is shown below. Attacks 1, 5, and 6 are attacks that occur in the browser.

1. Phishing
2. Ransomware
3. Denial of Service (DoS)
4. Man-in-the-middle (MiTM)
5. SQL Injection
6. Cross Site Scripting (XSS)
7. Zero-Day Exploits
8. DNS Spoofing

Both Phishing and Cross Site Scripting rely on links that a user clicks on to carry out the attack. In the case of Phishing the link is in often in an email.  

In this post, I'm going to focus on Phishing.  Both Phishing and Cross Site Scripting are forms of Social Engineering that rely on the user's trust and possibly lack of knowledge.  I'm going to focus on Phishing in this post because it is one of the most prevalent types of attack.

Companies are aware of the losses that result from cyber crimes, and instruct employees in what to look for to prevent attacks that involve links. However, the nature and attributes of the HTML anchor element that is used to create links might make it difficult for users to spot a problem with the link.

I've worked on product releases where the goal is rework any HTML that could create a vulnerability.  But in the end, if you tell a user to 'hover over each link on the email and make sure that the underlying URL looks OK', you're asking a lot.

Let's look at the anchor tag attribute variations that might make it difficult for a user to just hover over the link to determine if the link is OK.

**1. Expected Anchor Element.**
    The HTML anchor tag was created to make navigation between web 
    pages easier.  The structure of a basic anchor element does 
    this includes a URL assigned to an href attribute and text 
    content that describes where the URL will navigate to.

    ```html
    <a href="https://www.example.com" target="_blank">Example</a>
    ```
    The design of the anchor element strongly suggests that the 
    user shouldn't have to know what the URL is.  If the URL is to 
    be known, it could be copied in the text content.  If all the 
    URLs were spelled out, it would make for an unattractive and 
    probably messy looking web page.  This variation is the most 
    commonly used.  If the user hovers over `Example` they will see 
    `https://www.example.com`.

**2. Using `onclick` in an Anchor Element.** 
    We can introduce more complex instructions into the anchor tag 
    by adding an `onclick` event handler and JavaScript.  Here are 
    three examples of what we can do when we want to run some 
    JavaScript when the link is clicked.  In all cases, hovering 
    over the link won't show you the `onclick` event.

    **a. `onclick` returns false.**

    When you the JavaScript in the onclick handler returns false, 
    the navigation to the URL in href is not executed.  But if 
    there is a problem from the JavaScript itself, it's too late 
    once you've clicked on a link in which hovering over it showed 
    a URL that was OK

    ```html
    <a href="https://www.example.com" target="_blank" 
    onclick="alert('hello'); return false;">Say Hello</a>
    ```  
   
    **b. `onclick` doesn't return false.**

    If the `onclick` handler JavaScript code doesn't return false, 
    then the link will navigate as intended.  Hovering over the 
    link will return an OK URL and the code will navigate to the 
    URL.  In this case, all will seem well, but if the JavaScript 
    contained a problem, it's too late to fix it.  

    ```html
    <a href="https://www.example.com" onClick="alert('found me')" 
    target="_blank">onClick me</a>
    ```

    **c. anchor tag doesn't contain an href attribute.**  

    If the `href` is not included in the anchor tag element will 
    render without text decoration, but will still be clickable if 
    an `onclick` is included.  For users that are used to clickable 
    items showing some sign of click-ability like `text-decoration` 
    or a CSS that style to clickable text to look like a button, 
    there may be some confusion here.  A user instructed to hover 
    over links would likely ignore clicking on this entirely.  

    ```html
    <a onClick="alert('found me')" target="_blank">onclick me</a>
    ```
**3. No encryption in URL.** 

    If the URL references a site that doesn't use encryption, like 
    `http://www.example.com` vs. `https://www.example.com`, this 
    could a raise a question.  These days browser will often 
    encrypt the web page even if the scheme is `http`.  There are 
    extensions and settings to make browsers automatically encrypt, 
    but if the user hovers, and finds that HTTP instead of HTTPS is
    used, this could be the sign of a problem.

    ```html
    <a href="http://info.cern.ch/" target="_blank"
    onclick="alert('my href is unencrypted but chrome will 
    make it secure')"; 
    return true;>info.cern.ch is unencrypted</a>
    ```

**4. `href` refers to a URI with a `javascript:` pseudo scheme.**  

    Although it's most common to see a scheme in a URI like 
    `https:`, other schemes are in use.  For example `mailto:` and 
    `tel:` are used to send message via email and SMS.  These 
    schemes are followed by email addresses and telephone numbers. 
    These are refereed to as URI's instead of URL's.  The scheme is 
    provided an **identifier** instead of a **location**.  Both 
    `mailto:` and `tel:` are visible when hovering on a link.  

    It's also possible to use `javascript:` as a scheme.  It is 
    then followed by a call to a function in the context of the 
    HTML.  In the example below it is calling the function 
    `doSomething`.  This will be visible upon hovering, but because 
    the contents of the JavaScript code is not known, it may raise 
    a question.  
    
    ```html
    <a href="javascript:doSomething()">Javascript me</a>  
    ``` 
I hope the examples above show how difficult it could be for a user to determine if a link in their email should be clicked on or reported as a possible threat.  What's the solution?

## Create a Browser Extension 

What is needed is a full analysis and report on what is going on within the links on a webpage.  There needs to be a way to quickly generate some information that shows the links without hovering and provides alerts as to which links may have some unexpected attribute settings.  We need a Phish Bait analyzer report.  It would be nice if browsers had this feature, but until they do we can create a Chrome extension to do it.

I created an extension named [Link Reveal](https://chromewebstore.google.com/detail/link-reveal/fmmmcdmfaadidngnfnidhlmpgigmnhjh) and published it in the Chrome Web Store. I'm not the only one that thought of this.  If you search the Store for terms like "link" or "phish", you'll find many extensions that relate to the anchor tag.  If you're interested, you can also look at the [code](https://github.com/rebeccapeltz/link-reveal-ext).  There are a couple of test pages you can use:  

[Page with a lot of different anchor tags](https://www.beckypeltz.me/link-reveal-ext/).  
[Page with no anchor tags](https://www.beckypeltz.me/link-reveal-ext/nolinks.html). 
     
## Other Solutions that Preventing Phishing
The Chrome extension is useful for getting a better look at the attributes of rendered anchor elements.  In some cases, once an email web page is opened, the malware has already been installed. There are tools to investigate emails before they are opened.  Any links containing suspicious URLs or URI can be removed before the user can access them. This [blog](https://www.leadfeeder.com/blog/best-email-tracking-tools/) summarizes some of those tools and how they work.

## Learn More About Cybersecurity

The chart below shows that phishing is on the rise.

![Phishing attacks](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/pzevx1bofghytcm6olnv.png)
[credit: phishing-statistics](https://www.thesslstore.com/blog/phishing-statistics/)

Cybersecurity awareness is important for developers.  I joined [ICS2](https://www.isc2.org/) and learned a lot. 

See this [guide](https://rpeltz.gitbook.io/create-and-publish-a-chrome-browser-extension) for creating and publishing the browser extension described in this post.