113

I would like to know why is it considered to be dangerous to open an email from an unknown source?

I am using Gmail and I thought it's only unsafe to download an attachment and run it.

The first thing that came into my mind was what if the email text contains XSS JavaScript code but I am sure that every email provider has protected their site from getting XSS-ed.

What is going on behind the scenes when you get infected just by clicking on email and reading its content, for example on Gmail?

  • 42
    In the case of HTML email, csrf could be also used. eg : <img src="http://mybank/pay/?howmuch=500&to=attacker"/> – Xavier59 Sep 5 '16 at 10:05
  • 13
    Even if the xss xavier mentioned does not work, the attacker could verify the email using <img src="hackersite?id"> and you could get into the focus of massive spamming + bruteforcing – Jonas Wilms Sep 5 '16 at 14:53
  • 64
    Better yet, just don't read your email at all. It's always full of distracting requests that take time. :P – Peter Cordes Sep 5 '16 at 22:35
  • 10
    Back in the day, Eudora Pro would download and save to disk every attachment in every email one received (not even opened, just received). I once was hired by the defense team for a middle school principal accused of viewing inappropriate content at work. Every single image with nudity on his drive turned out to have been auto-downloaded by his email client. – Charles Duffy Sep 6 '16 at 14:57
  • 38
    @Xavier59 if you use an online banking service that sends payment information over GET requests, you have bigger security issues in your life than weird emails. – Justin Sep 7 '16 at 0:21

10 Answers 10

205

There is a small risk of an unknown bug — or a known but unpatched one — in your mail client allowing an attack by just viewing a message.

I think, though, that this very broad advice is also given as a defense against some types of phishing scams. Social engineering attacks are common and can lead to serious trouble. Making sure people are at least suspicious is a first line of defense. It is like telling an elderly grandparent to never give their credit card info over the phone — okay, sure, there are plenty of circumstances where doing that is relatively safe, but when they keep getting scammed over and over, it's easier to just say: don't do it.

Likewise, not opening mail keeps you from reading about the plight of an orphan in a war-torn region who has unexpectedly found a cache of Nazi gold and just needs $500 to smuggle it out and they'll share half with you, and your heart just goes out, and also that money wouldn't hurt.... Or, while you know the rule about attachments, this one says that it's pictures of the cutest kittens ever, and how can that be harmful — I'll just click it and okay now there are these boxes saying do I want to allow it, which is annoying because of course I do because I want to see the kittens....

| improve this answer | |
  • 60
    Love the last paragraph! – Lukas Sep 5 '16 at 15:53
  • 90
    Oh, and BTW, you also need to upgrade your video codec before you can see that little doggy video. – user13695 Sep 5 '16 at 19:25
  • 8
    The last paragraph is just brilliant. Also, mattdm, where is your fedora t-shirt? – grochmal Sep 5 '16 at 21:31
  • 6
    Glad everyone likes it. @grochmal, the shirt is in the laundry. :) – mattdm Sep 6 '16 at 13:27
  • 43
    Just hop on over to the Personal Finance StackExchange site and gasp in awe at the "Is this a scam?" questions people ask about there. (And then imagine how many people don't ask that question.) – Jörg W Mittag Sep 7 '16 at 15:12
62

Not for gmail, but for Outlook there have been a number of "preview pane" exploits where simply looking at the email is enough to compromise: Can malware be activated by previewing email in Outlook's Preview pane?

| improve this answer | |
  • 26
    Anything that renders HTML email via some web browser engine is vulnerable to the same exploits the HTML engine and the media rendering libraries it uses are vulnerable to. – rackandboneman Sep 6 '16 at 10:37
  • 4
    There are a couple still unpatched ones in Kontact/KDEPIM/KMail, too… ☹ – mirabilos Sep 6 '16 at 19:10
29

Even if nothing actively bad happens, many passively bad things can happen -- for example, you might view a one pixel transparent image tagged with your email address that flags you as the kind of person who opens and reads suspicious email. Those are lists that you don't want to be on.

| improve this answer | |
  • 7
    I thought every decent mail client was blocking inline images already? – John Dvorak Sep 5 '16 at 21:44
  • 1
    @JanDvorak Actually I noticed that recently, some clients stopped doing this. Also my client in particular never blocks external FLASH components. It's really crazy. – Tomáš Zato - Reinstate Monica Sep 6 '16 at 8:46
  • 9
    Gmail added image proxying so that you don't make the request directly to the original server: gmail.googleblog.com/2013/12/images-now-showing.html This doesn't stop individual tracking (ie, sending the user to example.com/images/example-at-gmail-dot-com.png and noting that it gets hit) since the proxy/cache apparently doesn't actually download the image until the user does. It just does the download once, and scans the image, but the attacker will still see you opened your e-mail. – Kevin Fee Sep 6 '16 at 16:44
  • 4
    Ah crap, I didn't know about that one. I always open them just to see what those people are up to now. I kind of enjoy reading their stories. Always cracks me up when I have another millionaire uncle or some prince of a non existing country wants to visit me. – miva2 Sep 7 '16 at 14:14
  • 2
    @miva2, search YouTube for "Scamalot"; you'll have a lot of fun. The best one is "Toaster." :) – Wildcard Sep 9 '16 at 20:27
13

Take the example of Gmail. Incoming email is pushed through mail filters, or milters. Each of these milters assesses the email based on characteristics. For example, sender status, SPF, DKIM, domain reputation, greylist, spamlists, contents, etc.. If the mail is not already rejected at this point, it will reach the antivirus scanner.

The scanner simply detaches the files in the mail content, and matches them with virus definitions. In the case of Gmail, archives are also unpacked to scan individual files. When no threats are found the email will be stored in your email folder.

However, this works great but Gmail cannot protect you from all threats. Strange compression formats or encrypted files can still slip through. XSS is highly unlikely because these type of exploits are recognized quite fast, either by Gmail or the browser. The best chance of infection is though a local mail client using extensions (eg. CVE-2015-6172) to load attached content.

| improve this answer | |
  • 4
    I did not know they were called milters. – David says Reinstate Monica Sep 5 '16 at 13:14
  • 24
    This doesn't answer the question. The OP wants to know if/why it's unsafe to simply open the email (i.e., view the message in his browser). He specifically says he's not asking about why it would be unsafe to open attachments. – Ben Crowell Sep 5 '16 at 14:55
  • 2
    How do the Google virus definitions compare to products such as AVG, Norton, McAffe etc.? Since Gmail is free, I kind of assume their virus definitions are "bare bones" and if I want better protection have to purchase a product? – BruceWayne Sep 5 '16 at 17:30
  • 2
    @BruceWayne We have no idea. They could rely on third parties to deal with this, or have their own database (more likely knowing Google). This topic took Gmail as an example, but I expect Outook.com to use something very similar to Windows Defender. – Yorick de Wid Sep 5 '16 at 17:42
  • 5
    @YorickdeWid: Where do you think the emails are stored? If Gmail receives an email, Google will scan it for viruses partially to keep Google servers from being infected. Then they store it, and you can then read your emails. – Mooing Duck Sep 5 '16 at 18:40
8

Generally it should be safe to view an email, but software is complex and very rarely perfect.

Although good software makers will try to make sure they display all emails in a safe way they have certainly made mistakes. When these bugs are discovered people will send crafted emails that exploit the bugs in some way and may install malicious software on your computer or do other unpleasant things.

A new bug could be discovered today in either Gmail or the web browser you use, and someone might send an email that exploits that bug before you get an update that fixes the bug.

The danger increases substantially if you use an old or unmaintained web browser or email client.

| improve this answer | |
  • 7
    old/non-updated software: That's typical for some people that need to be told not to open suspicious email. – Peter Cordes Sep 5 '16 at 22:33
4

There are ways to know you opened an email (for example, Mixmax is a Chrome's extension which tracks emails sent via Gmail by embedding a 0 length hidden image in the email's body).

Even when you do not allow images to be loaded automatically (when in Gmail you see at the top of the email a link with "Display images below"), if HTML is loaded, you're allowing possible exploiters to know you're reading them, which is a go-ahead for email-spam bombardment.

Therefore, answering the "why" question with another question: is it risky to open and load an unknown email with embedded HTML in it?

YES, just by opening an email in Gmail you may be sending data to potential attackers.

Other email clients that do not thoroughly block images of opened emails will also send the data when you open them.

| improve this answer | |
  • 2
    How does Mixmax know when you read the email? – KSFT Sep 11 '16 at 3:45
  • 1
    Gmail proxies images when they are received, so mixmax would not work. – Ave Sep 11 '16 at 17:41
  • @KSFT give it a try and test sending an email to a Gmail account and then open it through Gmail. You can click the little down triangle at the right and then "Show Original". Search for <img and you will find something like this <img = align=3D"left" width=3D"0" height=3D"0" style=3D"border:0; width:0px; = height:0px;" src=3D"https://app.mixmax.com/api/track/v2/...." alt=3D""> The ... part has the tracking ID that is used to identify your account and your email, once you open the email this <img> is loaded and that URL is accessed and thus registering the respective data in their DB. – CPHPython Sep 12 '16 at 10:13
  • @ardaozkal Well, just try it out instead of commenting "would not work". Mixmax does work, even when Gmail is blocking the images. This type of technology has been around for quite some time and analytics systems use it often (Facebook and Google). Unless you have another sort of plugin that blocks all of it, you will always be tracked once you open an email through a client that allows these embedded kind of images to be loaded. – CPHPython Sep 12 '16 at 10:20
  • @CPHPython I would try, but I don't use gmail. – Ave Sep 12 '16 at 11:05
2

Malicious links account for a majority of exploitation today. Malicious code (javascript mostly) is specially crafted to execute unwanted code via your browser. Just last week we saw the 3 iOS 0-days (see Trident/Pegasus) which started from a malicious email and possibly has been in the wild since 2014 (from security now) These links were even "one time use" links, had support for every iOS since 7, and was able to "jailbreak" the iOS remotely. My point is, I wouldn't worry about the actual "content" of the message so much as clicking on images or links in the email. While yes, there are tricks to loading scripts via image loading (or the like), modern browsers and emails clients have the ability to prevent scripting, so you can just turn that off. Solved.

| improve this answer | |
  • 2
    So what is you actual answer to the question? Is it dangerous to just open the mail? Or only dangerous if you click anything? Those are interesting examples, but the very end of your answer seems to imply that you think opening mails should be safe (if a client is configured correctly?) – Peter Cordes Sep 5 '16 at 22:37
  • Directly, yes that is what i am saying. Configure you're mail client to not load remote content and you will be as safe as you can be however, like i said, the real problem is clicking a link. – archae0pteryx Sep 6 '16 at 1:24
  • 1
    My point was that you should edit your answer to state your overall conclusion more clearly. I'd also suggest breaking it up into separate paragraphs. (I know, short paragraphs feel like they're too short, but sometimes they only need to be one sentence) – Peter Cordes Sep 6 '16 at 1:34
  • @PeterCordes. I do appreciate the comment. I am new at this. (obviously) so thanks! – archae0pteryx Sep 6 '16 at 15:50
  • 1
    I don't think that "as safe as can be" is true, since as other answers have pointed out, there have been plenty of preview-pane exploits, image-viewing exploits, etc. This feels like bad security advice, advocating bad security practices. – Dewi Morgan Sep 6 '16 at 18:16
2

The reality is that programs process data. These programs may contain bugs causing the program to behave completely differently than intended. Usually what happens in such circumstances is that the program will either be terminated by the operating system or just engages in random non-harmful behaviour. However, everything a program does is technically still deterministic (unless randomness is involved) - so what a program actually does when encountering data it processes wrong is deterministic thus attackers are able to construct data in a way to control exactly what the program does.

When receiving e-mails, your e-mail client is already processing data, so there's a good chance that an attacker can gain control of your e-mail program just by sending an e-mail to you - no matter if you actually look at it. The e-mail program will download the e-mail and, for example, display the Subject to you. When you open the e-mail, your e-mail client will likely do even more things, such as parsing the HTML in the e-mail, displaying the contents, displaying images etc. In everything it does (from parsing HTML, to rendering images, to rendering text, to downloading e-mails, to display the Subject), there can be a bug in it.

Opening a suspicious e-mail is only riskier because more stuff is processed when you actually open it.

When you visit a website (such as Gmail) and open an e-mail there, things are vastly different because Gmail is just a website like any other... except it displays e-mails. The issue there is that websites need to take into account that you can't just send the content of the e-mail raw to the browser because then there could be malicious HTML and/or malicious JavaScript in it. Technically this isn't too much different from sites like Wikipedia where users can write articles that contain formatting.

Of course, your browser will also use libraries to render text, process fonts, process images etc. so if there's a bug in an image library and the e-mail contains a malicious image then you're out of luck and it's not Gmail's fault. You can expect that the possible security vulnerabilities with Gmail are the same as the browser's, plus the issue of XSS and other web-specific security vulnerabilities.

This is also the reason why you'll get infected with stuff even when you don't visit any suspicious sites (and people usually mean porn, streaming, warez sites by that) is because even non-suspicious sites serve ads from different networks, so if an attacker infects an ad network somehow even the non-suspicious sites will serve you malware. Technically it's insecure to use third-party content you don't control. Think about what happens when an attacker manages to control a CDN that serves jquery or bootstrap or whatever, where thousands of sites are using it. Then all these sites will contain malicious javascript. To prevent that from happening there's SRI but I don't know how well supported that is as of now.

| improve this answer | |
  • SRI is a Recommendation though. – mroman Sep 8 '16 at 15:14
1

Opening a suspicious e-mail is only riskier because more stuff is processed when you actually open it. For example processing that can:

  1. track your IP

  2. perform XSS / CSRF / Command Injection if website is vulnerable.

  3. or in an advanced attack process a backdoored exe to gain terminal or root

| improve this answer | |
0

Opening suspicious emails can be dangerous depending on the configuration of your email client. If these settings allow code to run while you are just trying to view the textual content well the same thing can happen AS IF you opened an attachment or clicked a link. That’s what would be going on “behind the scenes” unintended code is running because you’ve clicked something to allow it, unless your email client, browser or OS stops it.

That's why the answer to your question so heavily depends on which email client is being used, and the settings you have on that client.

Gmail is using some tools to minimize this risk such as filters, anti-virus scanning, even archive scanning, but not clicking on that "display images" or clicking on anything within the email is going to minimize your risk to the lowest possible level.

Even if you do something as simple as click “display images” on an email, in Gmail, that Get request can send passive information to the bad guys bringing you one step closer to being a target because they know you make mistakes like clicking in emails you shouldn’t. Which is only a little dangerous right? But still dangerous.

Unlike older versions of Outlook, as of Nov 2019, I know of no Gmail based vulnerabilities that make looking at the textual content in Gmail unsafe. Clicking IN the email is the unsafe part.

I wonder if this needs to be said: just opening the email to read the content is UNSAFE if you ARE THE TYPE OF PERSON to be PERSUADED by the email, resulting in you yourself clicking the link or attachment.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.