Measures to safeguard against ZeroFont phishing attack

Question

What measures can be taken to safeguard against ZeroFont phishing attacks (setting font size to zero), and how can email security settings assist in the detection of ZeroFont elements and the identification of malicious characters?

Answer 1

This is a question about a very specific attack technique which was recently hyped with a catchy name: using the effect that the preview of the mail in some client like Outlook shows a different result than viewing the full mail and thus tricking the user.

In this hyped case it was used to make the user believe that the mail was scanned by a virus scanner, by displaying a message "scanned by ..." in the preview even if this message was not shown in the original mail.

The technique here were font settings inside the HTML which were ignored by the preview but not the real view, which led to different information displayed. Similar results can be achieved in a variety of ways, like using badly defined edge cases in the MIME format used for mail etc.

The underlying cause for the different display is that preview and main view of the mail use different ways to extract and show the information from the mail. This is an issue which would need to be fixed by the manufacturer of the mail program. This is unlikely to happen, since this problem will be considered minor. Another way to fix the different display would be to rewrite the mail inside some mail gateway, which will cause problems with signatures in S/MIME or PGP though and will also not work when end-to-end mail encryption (S/MIME, PGP) is used.

The other way to tackle the issue is to educate the user into not believing what the mail said. It was a bad practice from start the antivirus products started to add their own message inside the mail which claimed that the mail was scanned by the antivirus product. Such messages are easy to add without scanning the mail and so it is very common that attackers add such messages to their mail too in order to make them more trustworthy. Once the user does not believe this anymore it is actually irrelevant if this is still claimed in the mail preview or not.

The more general problem is though not about preview vs. main view but about analysis of the mail in some security product vs. how the mail is shown to the user. It is common for long that attackers make use of techniques to make a security product see different things than gets actually shown to the user and thus bypass the security product. "Zero font" is just another incarnation of this but not actually new either.

The underlying reasons of these more general problems are not restricted to mail either, but are the same for antivirus, firewalls etc: One are badly defined and complex data formats which lead to different interpretation by different implementations. The other is that most security products pass through the data in their original form instead of sanitizing the data in order to enforce consistent interpretation by the client.

At the end I think this specific "zero font" attack is nothing actually new but well hyped as part of product marketing. The specific vendor is well known for successfully hyping small things.

Given that most users and institutions face a variety of attacks - this specific one is likely one which is less relevant. And it should not be addressed in a way which specifically addresses this zero font attack, but by a) educating users about the class of problems (don't trust mail, no matter if it claimed to be passed to a security scanner) and b) using security products which sanitize the passed data in order to enforce a consistent interpretation between security scanner and what is shown to the user. Unfortunately, most products don't do this.