Is it possible to retrieve any information from my inbox / sent items using some scripts if I send the unsubscribe mail? If yes, how do we find if any information has been stolen?
People on this forum are generally going to acknowledge that "everything is possible." Instead, we concentrate on what's likely, probable, and worth defending against.
Applications like Outlook and Thunderbird read the link as a URL, and those URLs are linked to applications. mailto: will be opened by the default mail client, http / https will be opened by the browser. These URLs are then parsed, and action is taken on them.
It's the parsing that gets us in trouble. When input is parsed by the application (or the OS), it could be parsed in a manner that exploits some flaw and precipitates a bad result. One example: earlier this year, a flaw was discovered where a link click can crash your system.
So, links can be dangerous. Fortunately, there is a relatively safe way to deal with them: mouse over. When you mouse-over a link, it should display the destination. If it's an http or https or mailto link, then you should be relatively safe (until you're not). If you see a UNC link "\something" in an email, then that's definately not something you'd want to click on. Even an http(s) or mailto link might be suspect depending on the destination.
So the ultimate conclusion is: if you are running an unpatched, not up-to-date operating system and software, then the odds you'll be hit with something nasty from a link (or other sources) is much higher. (Using AV for protection is out of scope for this question, and generally triggers a Holy War. If you have additional questions on that, I'd post it on SuperUser.com).
Since my connection with the server is open, is it possible to contact the mail server by impersonating as me?
Assuming that you have a vulnerability as discussed above, anything is possible. So, yes.
If all it does is mark my email as active, what are the consequences of that?
I've dealt with spam extensively. Both in MS Exchange filtering, to Postfix, SpamAssassin and writing milters to filter spam. There are three things that a spammer cares about that will make your address a "value add:"
- That the email can be delivered. Deliverability is what these low-life's are selling when they sell your email.
- Open rates - that you opened the email marks it active. They do this with email tracking pixels.
- Some sort of activity (a click, a purchase, a phish, etc...).
So, your email gets marked as one or more of these - if you're dealing with a sophisticated spammer. However, most spammers are not even sophisticated enough to send RFC compliant email, their database handling skills are basically non-existent.
Chances are: you're already marked as one of the three classifications above. If your email has been breached, bad guys cross reference different breach lists. If the email appears on more than one, (and chances are, that's true too... thanks Yahoo, DropBox, Google, etc...) then you're on a separate, more valuable list.
So what to do?
You have to assume that if you receive an email, you're "active." If you open it to see what it is, you have already been marked as "active+open." So, there's no point in worrying what metadata some bad actor is is collecting on you. Your primary concern is (should be) protecting yourself.
Simple steps to do this:
Just delete obvious spam emails. The unsub links won't work 90% of the time, and when they do work, you've raised your hand as active. (That seems to be worthless to them these days since data breach data is so much more reliable... but why not avoid it?).
In the last year, at one of my sites, I monitored and did frequency analysis on just over 500,000,000 inbound emails over a period of six months. The only factor that increased the frequency of email to a given address was its age. The owner of the company had a 20+ year old email address, and he got the most. The next most senior employee had the next greatest spam level. And so on...
If the mouse-over reveals an https link, manually navigate to the site (in a sandbox) using copy paste, and go to the root of the site to see if it's legit. If so, then unsubs are probably honored.
If it's from a big company, unsubs must behonored (at least in the US). It's probably fine to unsubscribe.
Important
Read the URL carefully and always check the SSL certificate issuer for https links in the emails. Ransomware emails are crafted amazingly well in comparison to the rest of them. I have seen a few come through that were beautiful reproductions of UPS, FedEx, USPS, the IRS, and a few other major orgnization emails. I've seen some that came through that had working websites behind them claiming to be a city municipality complete with contact address, correct phone numbers, Google Maps addins, and what must have been a $3,000 website complete with SSL (signed by a Chinese CA. Pretty sure US municipailties won't be using a Chinese CA). These are sent as RFC compliant, DKIM signed, SPF compliant emails from non-day-old-bread domains in low volumes to keep from getting blacklisted. Spamassassin routinely classifies them as < 2. They either use a compliment domain ("irscompliance.us" instead of the legit irs.gov) or a duplicate letter (like Gooogle vs Google). These are pretty rare, but they are exquisitely crafted. It's almost as if all the spammers who were good at their job have switched to the ransomware industry.
