If I receive an email that has an attachment called something like
safe-link.html would it ever be safe to open this file?
Clearly, HTML files may have malicious scripts embedded that could run when opened with a browser. However, I'm wondering if any breaches could occur upon downloading the file and then opening it in Notepad / other basic text editor rather than a web browser?
I'm only asking because the company I work for like to send out 'test' phishing emails from time to time, and the latest had an HTML attachment. I suspected the email immediately (so didn't click to open the attachment in a browser), but I was intrigued to see if it actually was another test!
So I suggested to colleagues that the file be opened with Notepad. We’re all savvy enough to read HTML, so would immediately spot the usual "If this wasn't just a test, your computer would be compromised!”, but they were extremely concerned that I had thought to interact with the file at all.
I'm reasonably confident that any malicious script in an html file would have to be opened in a web browser for it to have any effect.
Are my colleagues being too cautious, or was I being overzealous?
I'm an advocate of "better safe than sorry", so I don't think they were wrong not to open it; I just also don't believe it was completely unsafe to open with something like Notepad. I am very intrigued to find out!
"Gotchas" I'm aware of:
I believe editing it in a more complex website development tool (that actually renders the page in a preview) could be dangerous.
Also, I'm aware that simply double clicking the file (even if the default "open with" is set to be a text editor) could be dangerous. This is because something like
readme.txt could actually be
readme.txt.exe with file extensions hidden in something like Windows File Explorer.