1

The full body of the message is:

<img border="0" src="http://eddinebox.com/rdt.php?t=591dc552a22ab037361c06e0op00u2wenVApp"/>

I don't understand how a PHP script could infect the client, but the message looks like it can only be malicious.

4
  • 5
    I suspect this is just a tracking pixel to check whether you've received (and read) the message.
    – Hayden
    May 19 '17 at 19:15
  • 5
    That's not running php, it's making a request for an image generated by a php script running on a remote server. The rest of the message is more likely to be the dangerous bit.
    – Matthew
    May 19 '17 at 19:20
  • 4
    The fact that the site uses PHP doesn't have a meaning to your mail client.
    – Arminius
    May 19 '17 at 19:27
  • Thanks for the replies. Just to be clear, that was the entire message except for an arbitrary line of text. And by 'client' I meant the computer on which the message was opened.
    – barncat
    May 19 '17 at 19:43
2

No

The PHP cannot infect the client because the PHP runs on the server which is "http://eddinebox.com" server. To infect the client, you need to have something that runs on the client. In browser, that would mean a javascript code that is not escaped properly by your email client.

On a different note, the PHP script can be used for Cross Site Request Forgery (CSRF) Attack. For example, the author of the email could use it to execute some action on another site as if it was you.

That said, as mentioned in the comments it's probably just a tracking code. When you open the email, it loads the PHP page. Then, the PHP page register which clients open the email and the parameter "t" is a unique code per client. It's a pretty standard technique for tracking.

2

As Gudradain said, no, it's not dangerous. Nothing to worry about.

To add a bit: it's in an tag. What happens is, the browser sees an tag, and looks at the src= attribute. Whatever is in the source, it does a request for that resource, exactly like if you'd typed it into your browser's URL bar.

When the response comes back, the browser expects it to be an image. It'll try to determine what kind of image the PHP file returned (if it's a jpg, png, etc), and render it as such. If it's indeed a tracking pixel, which is likely, it's just going to be a 1x1 white or transparent image.

If it's not an image - if it contains HTML, Javascript code, etc - it'll just be ignored, or rendered as a broken image. Nothing runs in your browser. This part is different from typing it into your URL bar: if you navigate to the page, it'll attempt to render it, no matter what it is (still perfectly safe). Whereas in an tag, it'll only render if it's an image.

(Gudradain also mentioned CSRF attacks - while it's true, if you aren't super familiar with CSRF, I wouldn't worry about it. If there's a CSRF vulnerability, it's in the site, not in your browser. It'd be pretty trivial to exploit by anyone from any site, and there's little you can do, as the user, to change that.)

0

I cannot tell by looking that this is malicious. My inclination is to assume it is not. Most malicious links will use bit.ly or tinyurl to hide the name of the domain it is reaching out to. But that does not mean this is wanted. Just because it is not installing a virus is not the whole picture.

I looked up the domain on that link I find an "information services" company - they are probably just tracking where the email goes and someone is paying them for that information.

The http request does disclose a lot about you. Certainly your IP address and probably your location. If you want to see how much info is sent along with an http request you can visit http://panopticlick.eff.org/ and let it run until it gives you your rating. Then click on the link that says to show you the full fingerprint.

As to your question, the problem is that is anything that executes in email can lead to installation of a virus.

It can be something as simple as a link to a website like you have shown.

Some websites have the ability to install a virus invisibly. We call them "Drive-By" installs. They are most prevalent on gambling or porn sites.

Or it may require you to click on something in the message like "unsubscribe", or you may have to download an attachment.

The one you have shown will be run even in a "preview" pane of MS-Outlook, for example, without you doing anything except deciding to delete it.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.