0

I have been reading the ROPEMAKER exploit whitepaper by Mimecast. In the article they are mentioning of sending a safe HTML(which may contain evil text, but as long as it is a plain HTML its safe with respect to the protective mechanisms at the recipients end) to the recipient and do the exploit by selectively displaying the necessary fields in the HTML using remotely loadable CSS.

I don't really get the idea of remotely loadable CSS for emails. How can an attacker/user send CSS along with the email body and load it remotely at the recipient end?

Is this actually possible? If yes, how?

Improve this question
1
  • 1
    I don't really understand your question, isn't this all fairly well described in the linked paper? Could you point at a specific passage you do not understand and try to specify your quetion?
    – Tom K.
    Commented Aug 24, 2017 at 15:17

1 Answer 1

Reset to default
1

There are two ways of include resources inside an email HTML part: as links to external sites (i.e. <img src=http://example.com/... or <link rel=stylesheet href=http://example.com/...) or by referencing different MIME parts inside the same mail (i.e. <link rel=stylesheet href="cid:some-id-in-the-mail">). The "exploit" just uses the first way, i.e. loading the CSS from a server controlled by the attacker where he can serve different CSS on different times, thus causing changes in the rendering of the HTML.

Improve this answer
2
  • do mail apps actually load external stylesheets? most of the html emails i see are very style-attribute heavy, i assumed that was because external CSS is blocked...
    – dandavis
    Commented Aug 24, 2017 at 21:20
  • @dandavis: it depends on mail client and settings. Many block all external resources (including images) by default but allow the user to load these resources. You might also have a look at the paper referenced in the question where they explicitly mention some affected mail clients like Outlook, Apple Mail and Thunderbird.
    – Steffen Ullrich
    Commented Aug 25, 2017 at 7:44

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .