Can my phone got infected if visit my mail inbox without opening any mail attachments?

Question

I've found some articles saying some viruses/malware can attack your device by just opening an email without downloading or opening any attachments.

Is this true?

If yes, how risky for ordinary mail users?

Answer 1

The email message has a certain structure/format which the mail client needs to parse in order to extract fields to show to you, e.g. the message subject and the sender (or senders).

Parsing involves processing the input sent to you by the third party, and they can send whatever they want. This is done using computer code which may contain certain errors and result in your client being compromised.

Yes, this is perfectly possible and doable but the attacker needs to know what your email client is because what works e.g. against Microsoft Outlook, may not work against Mozilla Thunderbird or The Bat!.

Here's an example: https://access.redhat.com/articles/7051467

You can find more by visiting this URL: https://www.google.com/search?q=email+parsing+vulnerability

This attack is unlikely if you're using the web mail, e.g. your email provider in the web browser.

Answer 2

It depends if there is a vulnerability i.e. (Buffer Overrun) that would allow this type of behavior on an email client.

The external adversary could leverage a chain of vulnerabilities or a single vulnerability within the email client that would allow attacks such as remote code execution of the target machine.

When the code base is either large or massive, there will always be vulnerabilities that are not fully in the public eye.

I always say, "You may be able to write your own program securely, but... you have to do that on top of an operating system with a kernel, and other environmental factors."

So, yes this could absolutely happen, without going into any technical details.

Here is a very short article which also covers basic concepts.

In the past, opening an email would have been enough for threat actors to install malware, ransomware, and other email viruses. For example, Outlook cybersecurity vulnerabilities permit hackers to run JavaScript and infect computers after a victim opens the message.

Answer 3

Your computer or phone must run some code that handles some input incorrectly, and from then on things can go wrong for you.

If you open an attachment with an image file, preferably in some obscure format, then your phone runs an image parser, and they are huge and complex and can have bugs, and there are megabytes of data that an attacker can use to hide code they want to execute. So that is more on the risky side.

If you just download the mail messages, that is much less data that the attacker can use. So it’s much harder to attack your phone. Not saying it is impossible, but it’s much harder. So it’s not impossible, but less likely that you can be attacked that way. And if the attacker just crashes your email reader, that’s very inconvenient but not a security risk.

Also, the email data itself has been processed by your email server, while data in attachments are just passed through. So an attacker must design data that passes through the email server but is not handled by your phone. That argument fails if the attacker is in control of the email server, for example a government forcing your ISP to send you dangerous email data. But that means you are not an “ordinary” user.