So, today an user sent me an e-mail about a suspicious e-mail. When I opened it to check it, I accidentaly hovered the mouse over the "doc.jpg" and it opened the image thumbnail. I never bothered to check the thumbnails, so I never stop to think about it, but would someone be able to execute malicious code in my computer if I checked the thumbnail?
EDIT: As requested, we're using Google Chrome 43.0.2357.134 and Zimbra 8.0(yep, kinda dated, but unfortunately, we can't do anything about it).
Maybe. In theory it might be that the (unknown) mail client you use already extracts information from the attachment when you simply hover over it. And the practice might not be that far away from this theory: There were several bugs in the past where the preview feature for mails could be used to execute malware, see Can malware be activated by previewing email in Outlook's Preview pane? or BadWinmail: the really bad Outlook flaw. There were also code execution in the past triggered by simply hovering over a file in explorer.
By default there is no such functionality that could be exploited itself. What is possible and mostly done with attached PDF's but also possible with other file formats is to exploit vulnerablities in the viewer software. This is the only way to compromize a system through a non executeable file. But also in that case the success of the attack relies on the viewer that is used which lowers the success rate because the exploit will only apply to one or a range of software.
So there is a possible attack vector but in my experience the attack surface increases with the complexity of a file format and in comparison to PDF image files are relatively trivial.
To sum it up: it's unlikely but not impossible to exploit a software by providing a manipulated image.
No because there exist a shortest path (of attack) and a dead end.
The thumbnail image is computed by your client E-mail reader from the original attachment. Hence an eventual attack code will have to go through this image filter. There are 2 possibilities at this level:
Within the 1st case, an attackant will try to use this flaw to attack this filter, and the bad will be inside once the thumbnail is computed. None of your action will change anything about this fact. The protection has to be done before by filtering E-mail.
Within the 2nd case, the attackant is out of luck, and will have to try another entry path.
The Government, FBI specifically if I recall correctly, (therefore also the NSA and CIA) openly uses software that can do this, at least on certain systems. If I recall correctly, they can infect you without even hovering or opening, just sending the attachment. This has been known for years, if you want a source, you will have to do some googling yourself.
But on average this is not at all likely, and not worth the effort unless you are a high profile target or something, due to the fact that this is considered a valuable 0-day vulnerability, the more it is used, the sooner it will be noticed and patched. If you could do this, you could sell it to corporations for $100k +, depending on which systems it works on. So a hacker would not use it loosely.
