LibraCyber ESG allows detailed configuration about scanning the HTML messages for potentially dangerous content. From this page, you can customize these sanitizations. All checks are enabled by default.
Dangerous content settings
The available sanitizations the appliance can perform on the message HTML are:
- Disarm <iframe> tags in emails
- Disarm <form> tags in emails
- Disarm <script> tags in emails
- Disarm tracking <img> tags in emails
- Disarm <!-- comments --> tags in emails
The <iframe> tag could be dangerous as the inline frame is used to embed another document within the current HTML page. The embedded document could be malicious. The <form> tag could be dangerous as represents a document section containing interactive controls for submitting information. The <script> tag could be very dangerous as represent a hidden active JavaScript code block. In the JavaScript language can be easily developed malwares that can take over the email client. The <img> tag could be dangerous as represents an image (external too) displayed on the email client that tracks users actions. This technique is called Web Bugs. The <!-- comments --> tag could be dangerous as an attacker could insert malicious code in them. Learn more reading the Outlook comments abusing proof of concept article written by Paolo Frizzi, LibraCyber CEO.
Note: when a customization is performed, click on the Save button in order to make all the changes effective.