Skip to main content
Information Security

Return to Question

added 54 characters in body
Source Link
Matthew
Matthew
  • 551
  • 1
  • 4
  • 8

If I receive an email that has an attachment called something like safe-link.html would it ever be safe to open this file?

Clearly, HTML files may have malicious scripts embedded that could run when opened with a browser. However, I'm wondering if any breaches could occur upon downloading the file and then opening it in Notepad / other basic text editor rather than a web browser?

Background

I'm only asking because the company I work for like to send out 'test' phishing emails from time to time, and the latest had an HTML attachment. I suspected the email immediately (so didn't click to open the attachment in a browser), but I was intrigued to see if it actually was another test!

So I openedsuggested to colleagues that the file be opened with Notepad and saw. We’re all savvy enough to read HTML, so would immediately spot the first few linesusual "If this wasn't just a test, your computer would be compromised!". After informing colleagues that it was another test”, but they were extremely concerned that I had interactedthought to interact with the file at all.

I'm reasonably confident that any malicious script in an html file would have to be opened in a web browser for it to have any effect.

Are my colleagues being too cautious, or was I being overzealous?

I'm an advocate of "better safe than sorry", so I don't think they were wrong not to open it; I just also don't believe it was completely unsafe to open with something like Notepad. I am very intrigued to find out!

"Gotchas" I'm aware of:

I believe editing it in a more complex website development tool (that actually renders the page in a preview) could be dangerous.

Also, I'm aware that simply double clicking the file (even if the default "open with" is set to be a text editor) could be dangerous. This is because something like readme.txt could actually be readme.txt.exe with file extensions hidden in something like Windows File Explorer.

If I receive an email that has an attachment called something like safe-link.html would it ever be safe to open this file?

Clearly, HTML files may have malicious scripts embedded that could run when opened with a browser. However, I'm wondering if any breaches could occur upon downloading the file and then opening it in Notepad / other basic text editor rather than a web browser?

Background

I'm only asking because the company I work for like to send out 'test' phishing emails from time to time, and the latest had an HTML attachment. I suspected the email immediately (so didn't click to open the attachment in a browser), but I was intrigued to see if it actually was another test!

So I opened the file with Notepad and saw the first few lines "If this wasn't just a test, your computer would be compromised!". After informing colleagues that it was another test, they were extremely concerned that I had interacted with the file at all.

I'm reasonably confident that any malicious script would have to be opened in a web browser for it to have any effect.

Are my colleagues being too cautious, or was I being overzealous?

I'm an advocate of "better safe than sorry", so I don't think they were wrong not to open it; I just also don't believe it was completely unsafe to open with something like Notepad. I am very intrigued to find out!

"Gotchas" I'm aware of:

I believe editing it in a more complex website development tool (that actually renders the page in a preview) could be dangerous.

Also, I'm aware that simply double clicking the file (even if the default "open with" is set to be a text editor) could be dangerous. This is because something like readme.txt could actually be readme.txt.exe with file extensions hidden in something like Windows File Explorer.

If I receive an email that has an attachment called something like safe-link.html would it ever be safe to open this file?

Clearly, HTML files may have malicious scripts embedded that could run when opened with a browser. However, I'm wondering if any breaches could occur upon downloading the file and then opening it in Notepad / other basic text editor rather than a web browser?

Background

I'm only asking because the company I work for like to send out 'test' phishing emails from time to time, and the latest had an HTML attachment. I suspected the email immediately (so didn't click to open the attachment in a browser), but I was intrigued to see if it actually was another test!

So I suggested to colleagues that the file be opened with Notepad. We’re all savvy enough to read HTML, so would immediately spot the usual "If this wasn't just a test, your computer would be compromised!”, but they were extremely concerned that I had thought to interact with the file at all.

I'm reasonably confident that any malicious script in an html file would have to be opened in a web browser for it to have any effect.

Are my colleagues being too cautious, or was I being overzealous?

I'm an advocate of "better safe than sorry", so I don't think they were wrong not to open it; I just also don't believe it was completely unsafe to open with something like Notepad. I am very intrigued to find out!

"Gotchas" I'm aware of:

I believe editing it in a more complex website development tool (that actually renders the page in a preview) could be dangerous.

Also, I'm aware that simply double clicking the file (even if the default "open with" is set to be a text editor) could be dangerous. This is because something like readme.txt could actually be readme.txt.exe with file extensions hidden in something like Windows File Explorer.

added tag --
Link
edit approved Apr 1, 2019 at 9:23
unor
edit approved Apr 1, 2019 at 9:23
unor
  • 1.8k
  • 1
  • 19
  • 40
Copy edited (e.g. ref. <http://en.wikipedia.org/wiki/HTML>, <http://en.wikipedia.org/wiki/Notepad_%28software%29>, and <https://en.wiktionary.org/wiki/browser#Noun>).
Source Link
edit approved Mar 30, 2019 at 15:50
Peter Mortensen
edit approved Mar 30, 2019 at 15:50
Peter Mortensen
  • 897
  • 5
  • 10

Is it ever safe to open a suspicious htmlHTML file (e.g. email attachment)?

If I receive an email that has an attachment called something like safe-link.html would it ever be safe to open this file?

Clearly, htmlHTML files may have malicious scripts embedded that could run when opened with a browser. However, I'm wondering if any breaches could occur upon downloading the file and then opening it in notepadNotepad / other basic text editor rather than a web browser?

Background

I'm only asking because the company I work for like to send out 'test' phishing emails from time to time, and the latest had a htmlan HTML attachment. I suspected the email immediately (so didn't click to open the attachment in a broswerbrowser), but I was intrigued to see if it actually was another test!

So I opened the file with notepadNotepad and saw the first few lines "If this wasn't just a test, your computer would be compromised!". After informing colleagues that it was another test, they were extremely concerned that I had interacted with the file at all.

I'm reasonably confident that any malicious script would have to be opened in a web browser for it to have any effect.

My question: areAre my colleagues being too cautious, or was I being overzealous?

I'm an advocate of "better safe than sorry", so I don't think they were wrong not to open it,it; I just also don't believe it was completely unsafe to open with something like notepadNotepad. VeryI am very intrigued to find out!

"Gotchas" I'm aware of:

I believe editing it in a more complex website development tool (that actually renders the page in a preview) could be dangerous.

Also, I'm aware that simply double clicking the file (even if the default "open with" is set to be a text editor) could be dangerous. This is because something like readme.txt could actually be readme.txt.exe with file extensions hidden in something like Windows File Explorer.

Is it ever safe to open a suspicious html file (e.g. email attachment)?

If I receive an email that has an attachment called something like safe-link.html would it ever be safe to open this file?

Clearly, html files may have malicious scripts embedded that could run when opened with a browser. However, I'm wondering if any breaches could occur upon downloading the file and then opening it in notepad / other basic text editor rather than a web browser?

Background

I'm only asking because the company I work for like to send out 'test' phishing emails from time to time, and the latest had a html attachment. I suspected the email immediately (so didn't click to open the attachment in a broswer) but was intrigued to see if it actually was another test!

So I opened the file with notepad and saw the first few lines "If this wasn't just a test, your computer would be compromised!". After informing colleagues that it was another test, they were extremely concerned that I had interacted with the file at all.

I'm reasonably confident that any malicious script would have to be opened in a web browser for it to have any effect.

My question: are my colleagues being too cautious, or was I being overzealous?

I'm an advocate of "better safe than sorry", so I don't think they were wrong not to open it, I just also don't believe it was completely unsafe to open with something like notepad. Very intrigued to find out!

"Gotchas" I'm aware of:

I believe editing it in a more complex website development tool (that actually renders the page in a preview) could be dangerous.

Also, I'm aware that simply double clicking the file (even if the default "open with" is set to be a text editor) could be dangerous. This is because something like readme.txt could actually be readme.txt.exe with file extensions hidden in something like Windows File Explorer.

Is it ever safe to open a suspicious HTML file (e.g. email attachment)?

If I receive an email that has an attachment called something like safe-link.html would it ever be safe to open this file?

Clearly, HTML files may have malicious scripts embedded that could run when opened with a browser. However, I'm wondering if any breaches could occur upon downloading the file and then opening it in Notepad / other basic text editor rather than a web browser?

Background

I'm only asking because the company I work for like to send out 'test' phishing emails from time to time, and the latest had an HTML attachment. I suspected the email immediately (so didn't click to open the attachment in a browser), but I was intrigued to see if it actually was another test!

So I opened the file with Notepad and saw the first few lines "If this wasn't just a test, your computer would be compromised!". After informing colleagues that it was another test, they were extremely concerned that I had interacted with the file at all.

I'm reasonably confident that any malicious script would have to be opened in a web browser for it to have any effect.

Are my colleagues being too cautious, or was I being overzealous?

I'm an advocate of "better safe than sorry", so I don't think they were wrong not to open it; I just also don't believe it was completely unsafe to open with something like Notepad. I am very intrigued to find out!

"Gotchas" I'm aware of:

I believe editing it in a more complex website development tool (that actually renders the page in a preview) could be dangerous.

Also, I'm aware that simply double clicking the file (even if the default "open with" is set to be a text editor) could be dangerous. This is because something like readme.txt could actually be readme.txt.exe with file extensions hidden in something like Windows File Explorer.

Tweeted twitter.com/StackSecurity/status/1111644357080293377
Became Hot Network Question
Post Migrated Here from serverfault.com (revisions)
Source Link
Matthew
Matthew
  • 551
  • 1
  • 4
  • 8