105

I would like to know why is it considered to be dangerous to open an email from an unknown source?

I am using Gmail and I thought it's only unsafe to download an attachment and run it.

The first thing that came into my mind was what if the email text contains XSS JavaScript code but I am sure that every email provider has protected their site from getting XSS-ed.

What is going on behind the scenes when you get infected just by clicking on email and reading its content, for example on Gmail?

  • 40
    In the case of HTML email, csrf could be also used. eg : <img src="http://mybank/pay/?howmuch=500&to=attacker"/> – Xavier59 Sep 5 '16 at 10:05
  • 12
    Even if the xss xavier mentioned does not work, the attacker could verify the email using <img src="hackersite?id"> and you could get into the focus of massive spamming + bruteforcing – Jonas Wilms Sep 5 '16 at 14:53
  • 59
    Better yet, just don't read your email at all. It's always full of distracting requests that take time. :P – Peter Cordes Sep 5 '16 at 22:35
  • 9
    Back in the day, Eudora Pro would download and save to disk every attachment in every email one received (not even opened, just received). I once was hired by the defense team for a middle school principal accused of viewing inappropriate content at work. Every single image with nudity on his drive turned out to have been auto-downloaded by his email client. – Charles Duffy Sep 6 '16 at 14:57
  • 38
    @Xavier59 if you use an online banking service that sends payment information over GET requests, you have bigger security issues in your life than weird emails. – Justin Lardinois Sep 7 '16 at 0:21
197

There's a small risk of an unknown bug — or a known but unpatched one — in your mail client allowing an attack by just viewing a message.

I think, though, that this very broad advice is given also as a defense against some types of phishing scams. Social engineering attacks are common and can lead to serious trouble, and making sure people are at least suspicious is a first line of defense. This is like telling an elderly grandparent to never give their credit card info over the phone — okay, sure, there are plenty of circumstances where doing so is relatively safe, but when they keep getting scammed over and over, it's easier to just say: don't do it.

Likewise, not opening mail keeps you from reading about the plight of an orphan in a war-torn region who has unexpectedly found a cache of Nazi gold and just needs $500 to smuggle it out and they'll share half with you, and your heart just goes out, and also that money wouldn't hurt.... Or, while you know the rule about attachments, this one says that it's pictures of the cutest kittens ever, and how can that be harmful — I'll just click it and okay now there are these boxes saying do I want to allow it, which is annoying because of course I do because I want to see the kittens....

  • 60
    Love the last paragraph! – Lukas Sep 5 '16 at 15:53
  • 89
    Oh, and BTW, you also need to upgrade your video codec before you can see that little doggy video. – Jan Doggen Sep 5 '16 at 19:25
  • 8
    The last paragraph is just brilliant. Also, mattdm, where is your fedora t-shirt? – grochmal Sep 5 '16 at 21:31
  • 6
    Glad everyone likes it. @grochmal, the shirt is in the laundry. :) – mattdm Sep 6 '16 at 13:27
  • 42
    Just hop on over to the Personal Finance StackExchange site and gasp in awe at the "Is this a scam?" questions people ask about there. (And then imagine how many people don't ask that question.) – Jörg W Mittag Sep 7 '16 at 15:12
58

Not for gmail, but for Outlook there have been a number of "preview pane" exploits where simply looking at the email is enough to compromise: Can malware be activated by previewing email in Outlook's Preview pane?

  • 24
    Anything that renders HTML email via some web browser engine is vulnerable to the same exploits the HTML engine and the media rendering libraries it uses are vulnerable to. – rackandboneman Sep 6 '16 at 10:37
  • 3
    There are a couple still unpatched ones in Kontact/KDEPIM/KMail, too… ☹ – mirabilos Sep 6 '16 at 19:10
28

Even if nothing actively bad happens, many passively bad things can happen -- for example, you might view a one pixel transparent image tagged with your email address that flags you as the kind of person who opens and reads suspicious email. Those are lists that you don't want to be on.

  • 6
    I thought every decent mail client was blocking inline images already? – John Dvorak Sep 5 '16 at 21:44
  • 1
    @JanDvorak Actually I noticed that recently, some clients stopped doing this. Also my client in particular never blocks external FLASH components. It's really crazy. – Tomáš Zato Sep 6 '16 at 8:46
  • 9
    Gmail added image proxying so that you don't make the request directly to the original server: gmail.googleblog.com/2013/12/images-now-showing.html This doesn't stop individual tracking (ie, sending the user to example.com/images/example-at-gmail-dot-com.png and noting that it gets hit) since the proxy/cache apparently doesn't actually download the image until the user does. It just does the download once, and scans the image, but the attacker will still see you opened your e-mail. – Kevin Fee Sep 6 '16 at 16:44
  • 4
    Ah crap, I didn't know about that one. I always open them just to see what those people are up to now. I kind of enjoy reading their stories. Always cracks me up when I have another millionaire uncle or some prince of a non existing country wants to visit me. – miva2 Sep 7 '16 at 14:14
  • 2
    @miva2, search YouTube for "Scamalot"; you'll have a lot of fun. The best one is "Toaster." :) – Wildcard Sep 9 '16 at 20:27
12

Take the example of Gmail. Incoming email is pushed through mail filters, or milters. Each of these milters assesses the email based on characteristics. For example, sender status, SPF, DKIM, domain reputation, greylist, spamlists, contents, etc.. If the mail is not already rejected at this point, it will reach the antivirus scanner.

The scanner simply detaches the files in the mail content, and matches them with virus definitions. In the case of Gmail, archives are also unpacked to scan individual files. When no threats are found the email will be stored in your email folder.

However, this works great but Gmail cannot protect you from all threats. Strange compression formats or encrypted files can still slip through. XSS is highly unlikely because these type of exploits are recognized quite fast, either by Gmail or the browser. The best chance of infection is though a local mail client using extensions (eg. CVE-2015-6172) to load attached content.

  • 4
    I did not know they were called milters. – David Grinberg Sep 5 '16 at 13:14
  • 24
    This doesn't answer the question. The OP wants to know if/why it's unsafe to simply open the email (i.e., view the message in his browser). He specifically says he's not asking about why it would be unsafe to open attachments. – Ben Crowell Sep 5 '16 at 14:55
  • 2
    How do the Google virus definitions compare to products such as AVG, Norton, McAffe etc.? Since Gmail is free, I kind of assume their virus definitions are "bare bones" and if I want better protection have to purchase a product? – BruceWayne Sep 5 '16 at 17:30
  • 2
    @BruceWayne We have no idea. They could rely on third parties to deal with this, or have their own database (more likely knowing Google). This topic took Gmail as an example, but I expect Outook.com to use something very similar to Windows Defender. – Yorick de Wid Sep 5 '16 at 17:42
  • 5
    @YorickdeWid: Where do you think the emails are stored? If Gmail receives an email, Google will scan it for viruses partially to keep Google servers from being infected. Then they store it, and you can then read your emails. – Mooing Duck Sep 5 '16 at 18:40
8

Generally it should be safe to view an email, but software is complex and very rarely perfect.

Although good software makers will try to make sure they display all emails in a safe way they have certainly made mistakes. When these bugs are discovered people will send crafted emails that exploit the bugs in some way and may install malicious software on your computer or do other unpleasant things.

A new bug could be discovered today in either Gmail or the web browser you use, and someone might send an email that exploits that bug before you get an update that fixes the bug.

The danger increases substantially if you use an old or unmaintained web browser or email client.

  • 5
    old/non-updated software: That's typical for some people that need to be told not to open suspicious email. – Peter Cordes Sep 5 '16 at 22:33
3

There are ways to know you opened an email (for example, Mixmax is a Chrome's extension which tracks emails sent via Gmail by embedding a 0 length hidden image in the email's body).

Even when you do not allow images to be loaded automatically (when in Gmail you see at the top of the email a link with "Display images below"), if HTML is loaded, you're allowing possible exploiters to know you're reading them, which is a go-ahead for email-spam bombardment.

Therefore, answering the "why" question with another question: is it risky to open and load an unknown email with embedded HTML in it?

YES, just by opening an email in Gmail you may be sending data to potential attackers.

Other email clients that do not thoroughly block images of opened emails will also send the data when you open them.

  • 2
    How does Mixmax know when you read the email? – KSFT Sep 11 '16 at 3:45
  • 1
    Gmail proxies images when they are received, so mixmax would not work. – Ave Sep 11 '16 at 17:41
  • @KSFT give it a try and test sending an email to a Gmail account and then open it through Gmail. You can click the little down triangle at the right and then "Show Original". Search for <img and you will find something like this <img = align=3D"left" width=3D"0" height=3D"0" style=3D"border:0; width:0px; = height:0px;" src=3D"https://app.mixmax.com/api/track/v2/...." alt=3D""> The ... part has the tracking ID that is used to identify your account and your email, once you open the email this <img> is loaded and that URL is accessed and thus registering the respective data in their DB. – CPHPython Sep 12 '16 at 10:13
  • @ardaozkal Well, just try it out instead of commenting "would not work". Mixmax does work, even when Gmail is blocking the images. This type of technology has been around for quite some time and analytics systems use it often (Facebook and Google). Unless you have another sort of plugin that blocks all of it, you will always be tracked once you open an email through a client that allows these embedded kind of images to be loaded. – CPHPython Sep 12 '16 at 10:20
  • @CPHPython I would try, but I don't use gmail. – Ave Sep 12 '16 at 11:05
2

Malicious links account for a majority of exploitation today. Malicious code (javascript mostly) is specially crafted to execute unwanted code via your browser. Just last week we saw the 3 iOS 0-days (see Trident/Pegasus) which started from a malicious email and possibly has been in the wild since 2014 (from security now) These links were even "one time use" links, had support for every iOS since 7, and was able to "jailbreak" the iOS remotely. My point is, I wouldn't worry about the actual "content" of the message so much as clicking on images or links in the email. While yes, there are tricks to loading scripts via image loading (or the like), modern browsers and emails clients have the ability to prevent scripting, so you can just turn that off. Solved.

  • 2
    So what is you actual answer to the question? Is it dangerous to just open the mail? Or only dangerous if you click anything? Those are interesting examples, but the very end of your answer seems to imply that you think opening mails should be safe (if a client is configured correctly?) – Peter Cordes Sep 5 '16 at 22:37
  • Directly, yes that is what i am saying. Configure you're mail client to not load remote content and you will be as safe as you can be however, like i said, the real problem is clicking a link. – archae0pteryx Sep 6 '16 at 1:24
  • 1
    My point was that you should edit your answer to state your overall conclusion more clearly. I'd also suggest breaking it up into separate paragraphs. (I know, short paragraphs feel like they're too short, but sometimes they only need to be one sentence) – Peter Cordes Sep 6 '16 at 1:34
  • @PeterCordes. I do appreciate the comment. I am new at this. (obviously) so thanks! – archae0pteryx Sep 6 '16 at 15:50
  • 1
    I don't think that "as safe as can be" is true, since as other answers have pointed out, there have been plenty of preview-pane exploits, image-viewing exploits, etc. This feels like bad security advice, advocating bad security practices. – Dewi Morgan Sep 6 '16 at 18:16
2

The reality is that programs processes data. These programs may contain bugs causing the program to behave completely differently than intended. Usually what happens in such circumstances is that the program will either be terminated by the operating system or just engages in random non-harmful behaviour. However, everything a program does is technically still deterministic (unless randomness is involved) - so what a program actually does when encountering data it processes wrong is deterministic thus attackers are able to construct data in a way to control exactly what the program does.

When receiving e-mails your e-mail client is already processing data so there's a good chance that an attacker can gain control of your e-mail program just by sending an e-mail to you - no matter if you actually look at it. The e-mail program will download the e-mail and for example display the Subject to you. When you open the e-mail your e-mail client will likely do even more things such as parsing the HTML in the e-mail, displaying the contents, displaying images etc. In everything it does (from parsing HTML, to rendering images, to rendering text, to downloading e-mails, to display the Subject) there can be a bug in it.

Opening a suspicious e-mail is only riskier because more stuff is processed when you actually open it.

When you visit a website (such as Gmail) and open an e-mail there things are vastly different because GMAIL is just a website like any other.... except it displays E-Mails to you. The issue there is that websites need to take into account that you can't just send the content of the e-mail raw to the browser because then there could be malicious HTML and/or malicious JavaScript in it. Technically this isn't too much different from sites like Wikipedia where users can write articles that contain formatting.

Of course, your browser will also use libraries to render text, process fonts, process images etc. so if there's a bug in an image library and the e-mail contains a malicious image then you're out of luck and it's not GMAIL's fault. You can expect that the possible security vulnerabilities with GMAIL are the same as the browser's plus the issue of XSS'n'Co security vulnerabilites.

Edit: This is btw. also the reason why you'll get infected with stuff even when you don't visit any suspicious sites (and people usually mean porn, streaming, warez sites by that) is because even non-suspicious sites serve ads from different networks so if an attacker infects an adnetwork somehow even the non-suspicious sites will serve you malware. Technically it's insecure to use third-party content you don't control. Think about what happens when an attacker manages to control a CDN that serves jquery or bootstrap or whatever where thousands of sites are using it then all these sites will contain malicious javascript. To prevent that from happening there's this: https://developer.mozilla.org/en-US/docs/Web/Security/Subresource_Integrity but I don't know how well supported that is as of now.

  • SRI is a Recommendation though. – mroman Sep 8 '16 at 15:14
0

Opening a suspicious e-mail is only riskier because more stuff is processed when you actually open it. like 1. Can track your IP 2. Can even perform XSS / CSRF / Command Injection if website is vulnerable. 3. In advance maybe a backdoored exe to gain terminal or root

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.