Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

This question already has an answer here:

You already know google started new service which is related to gmail.

http://gmailblog.blogspot.com/2013/11/attachments-in-gmail-now-with-power-of.html

When we send new mail to friends.If it contains any attachment(photo etc ) , photos will open directly with mail.

Is there any security problem with this subject?

Can I easily understand mail is opened or not?

What can attacker do with this feature and malicious code?

share|improve this question
    
You really should be more specific with your questions. "Is there any security problem with [email attachments]" is extremely vague. —— What's your specific concern? –  Joel L Dec 26 '13 at 12:48
    
For example attacker combined jpeg and malicious code.Then sent to my mail address. I just opened the mail. In this situation what can attacker do ? Is it still vague? –  dgn Dec 26 '13 at 13:41
add comment

marked as duplicate by Xander, AJ Henderson, Gilles, NULLZ, AviD Dec 27 '13 at 13:25

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

1 Answer

up vote 1 down vote accepted

There have been 2 recent changes to Gmail:

1.

Gmail will show images by default, proxied through Google's servers (and "checked for known viruses or malware"). If there's an exploitable vulnerability that can be embedded in a JPEG image, we'd probably have been screwed a long time ago since any website can also show images without any virus checks being run on them.

The changes probably don't affect open tracking. But you won't be able to see user IP addresses / user agent strings.

2.

Gmail will provide more options with regard to saving attachments. This should also not change anything since 1) old-style "open attachment" will still be available 2) attachments are scanned for viruses anyway. Attachments are parsed (for previews etc) server-side, so a (for example) PDF with malicious scripts won't affect users any more than with the old "trick user into opening a malicious file" method.

share|improve this answer
add comment

Not the answer you're looking for? Browse other questions tagged or ask your own question.