Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

Can someone know my IP address through Thunderbird email attachments?

Can a cunning attacker manage to find my IP address through attachment 'images' in emails that I unsuspectingly open?

share|improve this question

2 Answers 2

up vote 5 down vote accepted

It depends.

Assumption: by 'attachment image' you mean a HTML e-mail with embedded images that load from a remote location. In this case, if your Thunderbird client is set to automatically load images in e-mail, the answer is yes - an attacker controlling a web server can see where the connection came from.

On the other hand, if an attacker just sends you an e-mail with an image, then the answer is no. However, if the "image" is in fact not an image file but a carefully crafted file that crashes your image viewer in a way that allows the execution of code, then it's a different story. In this case the answer is obvious and the disclosure of your IP is likely your least concern..

Of course, if you're behind a NAT or other forms of routing, the attacker might see the public IP of your internet connection. Also, their e-mail might be opened by a mail server with a policy of caching images first, or a proxy might intercept and open your GET request for an image.

UPDATE By default Thunderbird does not load images:

By default, Thunderbird blocks remote images and other content in messages from people you don't know. This protects your privacy because spammers can verify your email address by detecting if you viewed a remote image in a message from them. Its also possible to embed an executable (malware) in images. When you receive a message with remote images, Thunderbird will display an alert stating that remote images have been blocked, and the images in the message body will be replaced with simple place-holders (screenshot). If you do want to view the remote images—for example, if you subscribe to an e-mail newsletter that regularly includes remote images—all you need to do is click the "Show Remote Content" button that appears to the right of the alert message. Older versions of Thunderbird used different names for that button such as "Show Images" or "Load Images".

(source)

share|improve this answer
    
Can you please mention how to disable automatic image loading? I could not figure out from the TB official guide. –  hnn Jun 27 at 12:29
    
@hnn I updated my answer. –  lorenzog Jun 27 at 12:58
    
I could see unwanted attached images in the email so either I don't use the default, or the default for me is to show the images. I'm on Linux and the guide you link is for windows TB. So wondering how to disable image display? –  hnn Jun 27 at 13:19
    
@hnn The guide I link does not mention windows or linux. Perhaps your problem is that the sender is in your address book. –  lorenzog Jun 27 at 13:26
1  
@hnn I'm sorry but this is the wrong place to ask for advice on how to use software. Have you tried on SuperUser? See also this answer for a similar problem: superuser.com/questions/332241/… –  lorenzog Jun 27 at 14:53

Yes, they can, and they don't even need to be especially cunning to do so. But you can prevent it.

When you receive an email in HTML format, the emails HTML code can embed images from an external webserver. Many email clients (not just Thunderbird) will then connect to that webserver to download the image. That way the webserver will learn your IP address. When the sender sends a mass email, they can embed an unique image URL in each individual email. That way they know if, when and from which IP address each email was opened. This is very useful for spammers, because it allows them to measure the success rate of their spam filter prevention measures and identify email addresses with a high view-rate so they can send them even more spam.

You can prevent this in Thunderbird under Tools->Options->Advanced->Privacy->Block loading of remote images. You will then no longer see images embedded in HTML emails which are not attached to the email themself, but most emails of that kind are spam anyway.

share|improve this answer
    
I'm using Thunderbird on linux and can not see Tools->Options->Advanced->Privacy->Block loading of remote images –  hnn Jun 27 at 11:42
    
Hi hnn, If a spammer or anyone sends you a mail, he knows your mailbox. If he knows your mailbox address, he knows your domain. If he knows your domain name, he definitely knows your MX record. The IP that points to your MX record is your mail server IP. This is same for all scenarios either he sends image or text or what ever... –  user169015 Jun 27 at 12:47
    
@user169015 First, there are countless abandoned email accounts in the world nobody reads anymore. Knowing how many of the addresses in their database are still actively read is important information for a spammer. Second, the spammer is interested in the IP address of your home computer, not in the IP address of your mail server. Most users share their mailserver with lots of other users. Learning the IP address of gmail.com or hotmail.com isn't hard, but not really valuable information. –  Philipp Jun 27 at 12:53
    
Hi Philip, Good to see you. What if the the remote person got a dynamic IP ... ?? I think majority internet users subscribes dynamic IP from their ISP... So knowing localhost IP is of no use... Even the internet user having a static IP, I don't think it will help the spammer to outbreak spams to his mailbox as sending and receiving mails doesn't involves localhost IP.. feel free to correct me if I am wrong.. –  user169015 Jun 27 at 13:04
    
The first part in your previous comment is a true fact.. But not sure how spammer checks whether the sent mail read by the end user.. Is there any way for the spammer to flag ON when someone open his mailbox.. just curious.. –  user169015 Jun 27 at 13:06

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.