Can an email message that runs PHP possibly infect the client?

Question

The full body of the message is:

<img border="0" src="http://eddinebox.com/rdt.php?t=591dc552a22ab037361c06e0op00u2wenVApp"/>

I don't understand how a PHP script could infect the client, but the message looks like it can only be malicious.

Answer 1

No

The PHP cannot infect the client because the PHP runs on the server which is "http://eddinebox.com" server. To infect the client, you need to have something that runs on the client. In browser, that would mean a javascript code that is not escaped properly by your email client.

On a different note, the PHP script can be used for Cross Site Request Forgery (CSRF) Attack. For example, the author of the email could use it to execute some action on another site as if it was you.

That said, as mentioned in the comments it's probably just a tracking code. When you open the email, it loads the PHP page. Then, the PHP page register which clients open the email and the parameter "t" is a unique code per client. It's a pretty standard technique for tracking.

Answer 2

As Gudradain said, no, it's not dangerous. Nothing to worry about.

To add a bit: it's in an tag. What happens is, the browser sees an tag, and looks at the src= attribute. Whatever is in the source, it does a request for that resource, exactly like if you'd typed it into your browser's URL bar.

When the response comes back, the browser expects it to be an image. It'll try to determine what kind of image the PHP file returned (if it's a jpg, png, etc), and render it as such. If it's indeed a tracking pixel, which is likely, it's just going to be a 1x1 white or transparent image.

If it's not an image - if it contains HTML, Javascript code, etc - it'll just be ignored, or rendered as a broken image. Nothing runs in your browser. This part is different from typing it into your URL bar: if you navigate to the page, it'll attempt to render it, no matter what it is (still perfectly safe). Whereas in an tag, it'll only render if it's an image.

(Gudradain also mentioned CSRF attacks - while it's true, if you aren't super familiar with CSRF, I wouldn't worry about it. If there's a CSRF vulnerability, it's in the site, not in your browser. It'd be pretty trivial to exploit by anyone from any site, and there's little you can do, as the user, to change that.)

Answer 3

I cannot tell by looking that this is malicious. My inclination is to assume it is not. Most malicious links will use bit.ly or tinyurl to hide the name of the domain it is reaching out to. But that does not mean this is wanted. Just because it is not installing a virus is not the whole picture.

I looked up the domain on that link I find an "information services" company - they are probably just tracking where the email goes and someone is paying them for that information.

The http request does disclose a lot about you. Certainly your IP address and probably your location. If you want to see how much info is sent along with an http request you can visit http://panopticlick.eff.org/ and let it run until it gives you your rating. Then click on the link that says to show you the full fingerprint.

As to your question, the problem is that is anything that executes in email can lead to installation of a virus.

It can be something as simple as a link to a website like you have shown.

Some websites have the ability to install a virus invisibly. We call them "Drive-By" installs. They are most prevalent on gambling or porn sites.

Or it may require you to click on something in the message like "unsubscribe", or you may have to download an attachment.

The one you have shown will be run even in a "preview" pane of MS-Outlook, for example, without you doing anything except deciding to delete it.