E-mail read receipt through XSS

Question

I recently stumbled upon a really silly/unsafe but an interesting way to get a read receipt of an e-mail. I'm not 100% sure if the method in use works, which is why I'm asking it here.

G-mail does not have read-receipts. So, I got this e-mail from a reputed company, a trusted source but G-mail had blocked the images on the page. Since it was from a trusted sender, I did click on "Show pictures in this email". I didn't see a picture there. On looking at the source, I saw an <img> tag with a src to a link which I think is a way to find out if the message was read by me.

My question :

1. Will this work ? Will the same origin policy prevent the request from going through or does the src in the <img> tag always issue a GET request

2. Is this legal and has anyone else seen this in practice? If it is not, I have a good mind to report this to the concerned company.

---

Extra Question

If this is indeed possible, then why wouldn't something like : <img onload=alert('XSS') src="some-path.jpg"> work ?

Answer 1

This is a fairly common practice called a web bug, it is the main reason that mail clients do not automatically load external images (the second being to protect you from viewing unwanted spam images that could be unsettling; e.g., pornography).

Basically when you load an email with external images enabled and a link to an image like <img src='http://192.1.1.1/images/53512_58925.png'> is in the source, their web server will log something like the following (example below is default access log for nginx web server) when your browser/mail client fetches and downloads the image:

10.1.2.3 - - [10/Oct/2012:10:33:41 -0400] "GET /images/53512_58925.png HTTP/1.1" 200 1933 "http://192.1.1.1/images/53512_58925.png" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.1 (KHTML, like Gecko) Chrome/21.0.1180.81 Safari/537.1"

which gives them:

1. your IP address of your computer where you viewed the email (10.1.2.3 in this example),
2. the timestamp of the access by the server's clock [10/Oct/2012:10:33:41 -0400],
3. the (first line of the) HTTP GET request to get the image (GET /images/53512_58925.png),
4. the HTTP response code (200 meaning success),
5. the size of the file being accessed (1933 bytes),
6. the full URL of the file (192.1.1.1 is IP of email sender's server), and
7. the User-Agent string of the client (indicating what web browser and possibly OS you are using).

To really track you accurately, they would need to have a unique URL for the image; e.g., the file 53512_58925.png could mean that user 58925 read the email with the ID 53512 or something. They could also do something with HTTP GET parameters something like <img src='http://192.1.1.1/images/logo.png?user_id=58925&email_id=53512'> that would also be logged.

I'm not going to comment on the legality of it; laws vary and some countries that I do not live in have recently enacted strict IT privacy laws (e.g., against a similar policy cookie tracking without explicit user consent). Also this forum is not really intended to provide legal advice.

This has nothing to do with same-origin policy (used for limiting the power of remotely loaded client-scripts in languages like javascript; so going to unsafe-web-page.com shouldn't be able to read/modify browser data in other tabs) or XSS (where attackers exploit flaws inject content in web pages that are not their own).

Answer 2

Embedding an image in an email would (if unblocked) fire a HTTP GET for the resource linked in the src field. When it does so, one can get the ordinary "Google Analytics level" of information (+ IP), i.e. Referrer, Browser version, etc.

If the resource does not exist, there will still be a log entry of the GET at the server side when trying to resolve it.

Answer 3

Yes it will work and I see no reason why it would be illegal.

However, you've already hit upon the main problem with doing this - the person reading the email must push "Show pictures in this email" (or equivalent) for it to work.

There are companies out there that offer this service, such as SpyPig and DidTheyReadIt