Don't Trust the Link

Email security tools and SOC analysts routinely submit suspicious links to URL scanning services to check for phishing. The speaker, who has spent years building and running security operations tooling, points out that the default public scan mode on urlscan.io makes each submitted link, along with its screenshots, redirects and results, searchable by anyone. The risk comes from how links are shared and scanned, since senders often cannot tell that a link carries private information.

The talk walks through examples found by searching the platform. These include an internal phishing-exercise link, a Microsoft sign-in link that auto-filled a user's email address, a LinkedIn unsubscribe link that could cancel marketing subscriptions when scanned, and secure mail registration and download links that gave access to message contents. A OneDrive share link exposed a tenancy agreement. The underlying issue is that a link works as a single factor of authentication, and optional protections such as second-factor checks or recipient verification are often left off by default.

The speaker's recommendations include keeping sensitive data out of URLs, requiring out-of-band second factors, using short link expiry, and choosing private scan settings where available. Security managers should also hunt for their organisation's data on such public sources, since a leak elsewhere can still become their problem. Reporting findings to the platform removes entries after review, but the speaker noted that a large amount of data remains exposed.