115

I would like to know why is it considered to be dangerous to open an email from an unknown source?

I am using Gmail and I thought it's only unsafe to download an attachment and run it.

The first thing that came into my mind was what if the email text contains XSS JavaScript code but I am sure that every email provider has protected their site from getting XSS-ed.

What is going on behind the scenes when you get infected just by clicking on email and reading its content, for example on Gmail?

13
  • 42
    In the case of HTML email, csrf could be also used. eg : <img src="http://mybank/pay/?howmuch=500&to=attacker"/>
    – Xavier59
    Sep 5, 2016 at 10:05
  • 13
    Even if the xss xavier mentioned does not work, the attacker could verify the email using <img src="hackersite?id"> and you could get into the focus of massive spamming + bruteforcing Sep 5, 2016 at 14:53
  • 64
    Better yet, just don't read your email at all. It's always full of distracting requests that take time. :P Sep 5, 2016 at 22:35
  • 10
    Back in the day, Eudora Pro would download and save to disk every attachment in every email one received (not even opened, just received). I once was hired by the defense team for a middle school principal accused of viewing inappropriate content at work. Every single image with nudity on his drive turned out to have been auto-downloaded by his email client. Sep 6, 2016 at 14:57
  • 38
    @Xavier59 if you use an online banking service that sends payment information over GET requests, you have bigger security issues in your life than weird emails. Sep 7, 2016 at 0:21

9 Answers 9

207

There is a small risk of an unknown bug — or a known but unpatched one — in your mail client allowing an attack by just viewing a message.

I think, though, that this very broad advice is also given as a defense against some types of phishing scams. Social engineering attacks are common and can lead to serious trouble. Making sure people are at least suspicious is a first line of defense. It is like telling an elderly grandparent to never give their credit card info over the phone — okay, sure, there are plenty of circumstances where doing that is relatively safe, but when they keep getting scammed over and over, it's easier to just say: don't do it.

Likewise, not opening mail keeps you from reading about the plight of an orphan in a war-torn region who has unexpectedly found a cache of Nazi gold and just needs $500 to smuggle it out and they'll share half with you, and your heart just goes out, and also that money wouldn't hurt.... Or, while you know the rule about attachments, this one says that it's pictures of the cutest kittens ever, and how can that be harmful — I'll just click it and okay now there are these boxes saying do I want to allow it, which is annoying because of course I do because I want to see the kittens....

5
  • 60
    Love the last paragraph!
    – Lukas
    Sep 5, 2016 at 15:53
  • 91
    Oh, and BTW, you also need to upgrade your video codec before you can see that little doggy video.
    – user13695
    Sep 5, 2016 at 19:25
  • 43
    Just hop on over to the Personal Finance StackExchange site and gasp in awe at the "Is this a scam?" questions people ask about there. (And then imagine how many people don't ask that question.) Sep 7, 2016 at 15:12
  • 3
    You might want to also mention that if viewing HTML mail your email client may invoke your browser or some other external program such as the Flash plug-in to show you the email (with all the security holes those programs have). Some emails may also embed web-bugs where pulling a picture embedded in the email tells the sender that you actually viewed the email (and when) because the unique URL the embedded picture was at was accessed then. Knowing someone looked at their email makes you an actual person and puts you on the prime list for future spamming. Sep 8, 2016 at 10:14
  • This advice also applies to unknown QR codes. :)
    – mattdm
    Feb 14 at 14:24
61

Not for gmail, but for Outlook there have been a number of "preview pane" exploits where simply looking at the email is enough to compromise: Can malware be activated by previewing email in Outlook's Preview pane?

2
  • 26
    Anything that renders HTML email via some web browser engine is vulnerable to the same exploits the HTML engine and the media rendering libraries it uses are vulnerable to. Sep 6, 2016 at 10:37
  • 4
    There are a couple still unpatched ones in Kontact/KDEPIM/KMail, too… ☹
    – mirabilos
    Sep 6, 2016 at 19:10
30

Even if nothing actively bad happens, many passively bad things can happen -- for example, you might view a one pixel transparent image tagged with your email address that flags you as the kind of person who opens and reads suspicious email. Those are lists that you don't want to be on.

6
  • 7
    I thought every decent mail client was blocking inline images already? Sep 5, 2016 at 21:44
  • 1
    @JanDvorak Actually I noticed that recently, some clients stopped doing this. Also my client in particular never blocks external FLASH components. It's really crazy. Sep 6, 2016 at 8:46
  • 9
    Gmail added image proxying so that you don't make the request directly to the original server: gmail.googleblog.com/2013/12/images-now-showing.html This doesn't stop individual tracking (ie, sending the user to example.com/images/example-at-gmail-dot-com.png and noting that it gets hit) since the proxy/cache apparently doesn't actually download the image until the user does. It just does the download once, and scans the image, but the attacker will still see you opened your e-mail.
    – Kevin Fee
    Sep 6, 2016 at 16:44
  • 4
    Ah crap, I didn't know about that one. I always open them just to see what those people are up to now. I kind of enjoy reading their stories. Always cracks me up when I have another millionaire uncle or some prince of a non existing country wants to visit me.
    – miva2
    Sep 7, 2016 at 14:14
  • 2
    @miva2, search YouTube for "Scamalot"; you'll have a lot of fun. The best one is "Toaster." :)
    – Wildcard
    Sep 9, 2016 at 20:27
14

Take the example of Gmail. Incoming email is pushed through mail filters, or milters. Each of these milters assesses the email based on characteristics. For example, sender status, SPF, DKIM, domain reputation, greylist, spamlists, contents, etc.. If the mail is not already rejected at this point, it will reach the antivirus scanner.

The scanner simply detaches the files in the mail content, and matches them with virus definitions. In the case of Gmail, archives are also unpacked to scan individual files. When no threats are found the email will be stored in your email folder.

However, this works great but Gmail cannot protect you from all threats. Strange compression formats or encrypted files can still slip through. XSS is highly unlikely because these type of exploits are recognized quite fast, either by Gmail or the browser. The best chance of infection is though a local mail client using extensions (eg. CVE-2015-6172) to load attached content.

10
  • 4
    I did not know they were called milters. Sep 5, 2016 at 13:14
  • 24
    This doesn't answer the question. The OP wants to know if/why it's unsafe to simply open the email (i.e., view the message in his browser). He specifically says he's not asking about why it would be unsafe to open attachments.
    – user51881
    Sep 5, 2016 at 14:55
  • 2
    How do the Google virus definitions compare to products such as AVG, Norton, McAffe etc.? Since Gmail is free, I kind of assume their virus definitions are "bare bones" and if I want better protection have to purchase a product?
    – BruceWayne
    Sep 5, 2016 at 17:30
  • 2
    @BruceWayne We have no idea. They could rely on third parties to deal with this, or have their own database (more likely knowing Google). This topic took Gmail as an example, but I expect Outook.com to use something very similar to Windows Defender. Sep 5, 2016 at 17:42
  • 5
    @YorickdeWid: Where do you think the emails are stored? If Gmail receives an email, Google will scan it for viruses partially to keep Google servers from being infected. Then they store it, and you can then read your emails. Sep 5, 2016 at 18:40
8

Generally it should be safe to view an email, but software is complex and very rarely perfect.

Although good software makers will try to make sure they display all emails in a safe way they have certainly made mistakes. When these bugs are discovered people will send crafted emails that exploit the bugs in some way and may install malicious software on your computer or do other unpleasant things.

A new bug could be discovered today in either Gmail or the web browser you use, and someone might send an email that exploits that bug before you get an update that fixes the bug.

The danger increases substantially if you use an old or unmaintained web browser or email client.

1
  • 7
    old/non-updated software: That's typical for some people that need to be told not to open suspicious email. Sep 5, 2016 at 22:33
4

There are ways to know you opened an email (for example, Mixmax is a Chrome's extension which tracks emails sent via Gmail by embedding a 0 length hidden image in the email's body).

Even when you do not allow images to be loaded automatically (when in Gmail you see at the top of the email a link with "Display images below"), if HTML is loaded, you're allowing possible exploiters to know you're reading them, which is a go-ahead for email-spam bombardment.

Therefore, answering the "why" question with another question: is it risky to open and load an unknown email with embedded HTML in it?

YES, just by opening an email in Gmail you may be sending data to potential attackers.

Other email clients that do not thoroughly block images of opened emails will also send the data when you open them.

7
  • 2
    How does Mixmax know when you read the email?
    – KSFT
    Sep 11, 2016 at 3:45
  • 1
    Gmail proxies images when they are received, so mixmax would not work.
    – ave
    Sep 11, 2016 at 17:41
  • @KSFT give it a try and test sending an email to a Gmail account and then open it through Gmail. You can click the little down triangle at the right and then "Show Original". Search for <img and you will find something like this <img = align=3D"left" width=3D"0" height=3D"0" style=3D"border:0; width:0px; = height:0px;" src=3D"https://app.mixmax.com/api/track/v2/...." alt=3D""> The ... part has the tracking ID that is used to identify your account and your email, once you open the email this <img> is loaded and that URL is accessed and thus registering the respective data in their DB.
    – CPHPython
    Sep 12, 2016 at 10:13
  • @ardaozkal Well, just try it out instead of commenting "would not work". Mixmax does work, even when Gmail is blocking the images. This type of technology has been around for quite some time and analytics systems use it often (Facebook and Google). Unless you have another sort of plugin that blocks all of it, you will always be tracked once you open an email through a client that allows these embedded kind of images to be loaded.
    – CPHPython
    Sep 12, 2016 at 10:20
  • @CPHPython I would try, but I don't use gmail.
    – ave
    Sep 12, 2016 at 11:05
2

Malicious links account for a majority of exploitation today. Malicious code (javascript mostly) is specially crafted to execute unwanted code via your browser. Just last week we saw the 3 iOS 0-days (see Trident/Pegasus) which started from a malicious email and possibly has been in the wild since 2014 (from security now) These links were even "one time use" links, had support for every iOS since 7, and was able to "jailbreak" the iOS remotely. My point is, I wouldn't worry about the actual "content" of the message so much as clicking on images or links in the email. While yes, there are tricks to loading scripts via image loading (or the like), modern browsers and emails clients have the ability to prevent scripting, so you can just turn that off. Solved.

7
  • 2
    So what is you actual answer to the question? Is it dangerous to just open the mail? Or only dangerous if you click anything? Those are interesting examples, but the very end of your answer seems to imply that you think opening mails should be safe (if a client is configured correctly?) Sep 5, 2016 at 22:37
  • Directly, yes that is what i am saying. Configure you're mail client to not load remote content and you will be as safe as you can be however, like i said, the real problem is clicking a link. Sep 6, 2016 at 1:24
  • 1
    My point was that you should edit your answer to state your overall conclusion more clearly. I'd also suggest breaking it up into separate paragraphs. (I know, short paragraphs feel like they're too short, but sometimes they only need to be one sentence) Sep 6, 2016 at 1:34
  • @PeterCordes. I do appreciate the comment. I am new at this. (obviously) so thanks! Sep 6, 2016 at 15:50
  • 1
    I don't think that "as safe as can be" is true, since as other answers have pointed out, there have been plenty of preview-pane exploits, image-viewing exploits, etc. This feels like bad security advice, advocating bad security practices. Sep 6, 2016 at 18:16
2

The reality is that programs process data. These programs may contain bugs causing the program to behave completely differently than intended. Usually what happens in such circumstances is that the program will either be terminated by the operating system or just engages in random non-harmful behaviour. However, everything a program does is technically still deterministic (unless randomness is involved) - so what a program actually does when encountering data it processes wrong is deterministic thus attackers are able to construct data in a way to control exactly what the program does.

When receiving e-mails, your e-mail client is already processing data, so there's a good chance that an attacker can gain control of your e-mail program just by sending an e-mail to you - no matter if you actually look at it. The e-mail program will download the e-mail and, for example, display the Subject to you. When you open the e-mail, your e-mail client will likely do even more things, such as parsing the HTML in the e-mail, displaying the contents, displaying images etc. In everything it does (from parsing HTML, to rendering images, to rendering text, to downloading e-mails, to display the Subject), there can be a bug in it.

Opening a suspicious e-mail is only riskier because more stuff is processed when you actually open it.

When you visit a website (such as Gmail) and open an e-mail there, things are vastly different because Gmail is just a website like any other... except it displays e-mails. The issue there is that websites need to take into account that you can't just send the content of the e-mail raw to the browser because then there could be malicious HTML and/or malicious JavaScript in it. Technically this isn't too much different from sites like Wikipedia where users can write articles that contain formatting.

Of course, your browser will also use libraries to render text, process fonts, process images etc. so if there's a bug in an image library and the e-mail contains a malicious image then you're out of luck and it's not Gmail's fault. You can expect that the possible security vulnerabilities with Gmail are the same as the browser's, plus the issue of XSS and other web-specific security vulnerabilities.

This is also the reason why you'll get infected with stuff even when you don't visit any suspicious sites (and people usually mean porn, streaming, warez sites by that) is because even non-suspicious sites serve ads from different networks, so if an attacker infects an ad network somehow even the non-suspicious sites will serve you malware. Technically it's insecure to use third-party content you don't control. Think about what happens when an attacker manages to control a CDN that serves jquery or bootstrap or whatever, where thousands of sites are using it. Then all these sites will contain malicious javascript. To prevent that from happening there's SRI but I don't know how well supported that is as of now.

1
  • SRI is a Recommendation though.
    – mroman
    Sep 8, 2016 at 15:14
1

Opening a suspicious e-mail is only riskier because more stuff is processed when you actually open it. For example processing that can:

  1. track your IP

  2. perform XSS / CSRF / Command Injection if website is vulnerable.

  3. or in an advanced attack process a backdoored exe to gain terminal or root

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.