Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

Consider if I have got a mail from a colleague on my GMail, and it has got some images or attachments in it. Gmail asks for "Show Images" option to explore images.

My query is that how can we get to know that these images or attachments are not for tracking our IP from websites like ReadNotify. Is something to be noticed in email header ? What all other products are their like ReadNotify ?

share|improve this question
1  
You would have to view the html contents of the email before you allowed Google to display the images. By default Google will not display images from untrusted sources. Furthermore once the image is approved and displayed within the email what happens on the source server is out of your hands –  Ramhound Jul 23 '13 at 18:14

3 Answers 3

You have no way to know. The IP tracking is performed by the server that serves you the image. The server necessarily knows that it served some image file, but you have no way -- as a client -- to know whether the server does anything meaningful with that information, or whether the image load could be traced back to you personally.

If it's a mass email, the image URL would probably have your email address in it (or, more likely, some randomly-generated unique ID that maps to your email in a server-side database). That's so the server knows whose IP they're getting with each image load. (e.g., "Okay, 11.22.33.44 just loaded the URL /images/35fd76a74/track.png... from our records, we sent that URL to foobar@example.com.) However, if an information gathering effort is focused on only you (or the service is very clever in how it encodes unique IDs in their URL), the URL could look perfectly mundane.

In order to decide if an image is used to track your IP address, you'd have to decide whether the server associates the loaded image uniquely back to your email address. Since you don't run the server, this is generally not possible. If some image is known to be widely used (e.g., just a /static/img/header.png that the sender puts in every single one of their emails to many recipients, without any kind of unique ID in the URL) then it's unlikely that that image could be used for tracking: too many people load that same image for the originating IPs of its requests to be uniquely linked back to a particular recipients.

If you fetch the images through an anonymizing proxy, you can hide your IP address. However, a proxy cannot hide the fact that the image was requested at all. The server would still know that /images/35fd76a74/track.png was loaded (and that that unique ID links back to your email address), but they simply don't know what your real IP is.

share|improve this answer
4  
Might be worth pointing out that the unique identifier doesn't have to be in the query part of the URL, it could as well be in the path, or any other part of it, and server configured accordingly (say, with a redirect to some static resource). E.g. http://example.com/548985314/images/logo.jpg, and the server setup in such a way to reformat request URL and redirect to http://example.com/someapp.cgi?id=548985314 serving the image and translating the unique ID into the email address through the use of a local database, or anything like that. ;) –  TildalWave Jul 23 '13 at 11:59
2  
@TildalWave That's a fair point. I edited my answer to make the path look like your first example. I hope that makes it clearer to readers not well versed in HTTP that there is nothing "magic" about where the ID lies in the URL path; as long as it's in the HTTP request somewhere, the server can easily extract it. (In any case, you comment will certainly do so, if my answer does not.) –  apsillers Jul 23 '13 at 13:12
    
@apsillers : Thanks for the reply, so their are preventions but no detection for this. –  wek Jul 23 '13 at 14:29

You can't easily determine this. Any DNS or HTTP query that happens as a result of you clicking on a link, or showing images can send your IP address to a third party.

Additional ways an email can track your IP (though commonly done on a MTA, it can be done client side)

  • Antispam software may verify DMARC headers which include a DNS lookup
  • DMARC verification of a DMARC header via DNS
  • If you view your email in a web browser, (or sandboxed browser like Outlook) it may be possible to include "active" content via Javascript, CSS, or other external dependencies.
share|improve this answer
    
Thanks for reply. Is their any way to track out the image or links path where it will be going after clicking image or link. –  wek Jul 23 '13 at 14:27
    
@wek - Just don't allow google mail to display the images. The location of the images cannot be modified since any other location would be invalid. Any attempt to download them would verify and the purpose of the tracking would be acomplished. –  Ramhound Jul 23 '13 at 18:17
    
@Ramhound : Yes you are right, but my question is weather we can detect such tracking or not. Because by default google disables all the images in the inbox. –  wek Jul 24 '13 at 7:39
    
@wek - You cannot detect what sort of tracking happens on third-party server. Furthermore you cannot tell if an image is being generate dynamically or is a static image. –  Ramhound Jul 24 '13 at 11:03

I dont know if this helps, but using an add-on like tamper data in Firefox, you can know about the outbound requests from a client. You can use this add-on to make sure that there are no conversations are happening between the browser and the server when you load the images.

Even if there are conversations, you can see the content in the conversations and can make sure that no value like IP is sent (Not atleast in plain text).

share|improve this answer
    
Ok.I don't know if this approach really works as I used Tamper Data very little.But if it works ,then also our IP will be send to the server I think.But its nice approach.Have you tried BurpSuit ? Will it be more good then TamperData ? –  wek Jul 24 '13 at 7:35
1  
IP is sent at layer 3 (network layer) and is necessary to receive a response from the server. Tamper Data alters layer 7 HTTP headers. –  apsillers Jul 24 '13 at 11:39
    
@wek: Yes I have used burp, like apsillers said, IP is sent at layer3, and is a mandatory thing. What I was pointing to is that, if there is another way than Layer3 tracking,like the mail may send the ip with an ajax call or something (may be a dumb idea, but can be done with javascript.), that is what we could check with tamper data. Burp or Webscarab is always better than Tamper data because they are intercepting proxies, which means they are made for that purpose. –  the Injector Jul 31 '13 at 9:43

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.