0

Sometimes you receive some emails which are mostly (and correctly) categorized as spam email by your email provider and you are almost sure that they are in fact spams. However, you are curious to open and take a look at the contents of some of them to see what they have. I was wondering is there any risk involved at receiving/opening such emails, of course without clicking on any of its links or downloading its attachments? Is it recommended to not even open them at any case?

Further, It would be great if you could consider and compare in your answer the cases of using an established email provider (e.g. Gmail, Yahoo, Live, etc.) vs. the ordinary (self-hosted) email systems, as well as the difference (if any) in this regard between using internet browsers for viewing email vs. using email software clients (e.g. Mozilla Thunderbird, Microsoft Mail, etc.) or mobile email apps.

Improve this question
1

The majority of the emails programs organize the messages on two formats:

  • All the messages in one file.
  • One file per message.

Is fine if you open the file message with vim, notepad or so program that don't do any parsing and potentially can execute something such as attachment, or follow a HTTP link. With any other program I will be skeptical of opening but just because I don't know what is going to do the program that opens the message with an infected body part for example.

Improve this answer
  • So do you mean even using email client softwares/apps may have potential risks? and therefore it is not safe to open spam emails with them? What about using a browser? – today Dec 5 '18 at 14:18
  • Basically Yes, I dont know what is going to do outlook when open the email, extract the body parts? the attachments? if the attachment is an executable file, execute? follow the http links?. The same concern about a browser. Just programs that don't pre process the file basically. – camp0 Dec 5 '18 at 14:38
-2

No high risk threat (no data compromise if you don't click on anything) as long as JavaScript is disabled in an email service, Most of them do disable that. By doing some tricks, Like Embedding an Php page as hidden in the body of email, Which leads to be malicious and be flagged as spam, The attacker can get log of your location, ip, Browser version, Monitor resolution, the amount of time you spend on reading that, the heatmap of your mouse and etc which can be used in further social engineering attacks.

I personally have tested Gmail, Yahoo, Live and their security filters is very acceptable and is hard to bypass.

Generally most malicious (spam) emails are:

  1. Using an hidden php page to log and track their attack
  2. Using Malware as attachment
  3. Using common content like jobs, password recovery, Asking for Ransom and ...
Improve this answer
  • 1
    That is bad advice. There are more ways to execute code through email than just JavaScript, and many that can be triggered simply by viewing the email (even in preview mode) without having to click on anything inside of the email. – Jesse P. Dec 5 '18 at 15:22
  • @JesseP. Why didn't you provide or at least point to a better answer then? – topshot Mar 5 '19 at 19:31

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.