2

I've noticed that the subject in one of the spam emails looks like this in source:

Subject: Offe=?UTF-8?Q?=EF=BB=BF?=r fr=?UTF-8?Q?=EF=BB=BF?=om C=?UTF-8?Q?=EF=BB=BF?=redi=?UTF-8?Q?=EF=BB=BF?=t On=?UTF-8?Q?=EF=BB=BF?=e Ba=?UTF-8?Q?=EF=BB=BF?=nk=?UTF-8?Q?=EF=BB=BF?==?UTF-8?Q?=EF=BB=BF?=

but in web it looks normal

Offer from Credit One Bank

The only thing I recognize is 0xEF, 0xBB, 0xBF, which is the UTF-8 BOM.

Which interpreter recognizes this character sequence =?UTF-8?Q?=EF=BB=BF?= ?

Is there a vulnerability around email subjects? What are they trying to do?

  • 2
    They're trying to obfuscate the email from being detected by spam filters. – Ghedipunk Jul 11 '19 at 18:10
  • 2
    Rather than editing your answer into your question, you should self-answer. – Fund Monica's Lawsuit Jul 11 '19 at 19:24
2

This is called quoted-printable formatting and it is required in email because RFC 5322 (.eml, originally RFC 822) explicitly allows only ASCII characters, so RFC 2047 presents an "ASCII-armor" (to borrow a term from PGP) format to encode non-ASCII text as either quoted-printable or base64.

This is formatted like =?CHARSET?ENCODING?CONTENT?=

Quoted-printable is particularly useful for when the content is mostly ASCII, so for example Chris España could be encoded as =?UTF-8?Q?Chris Espa=F1a?= rather than base64's longer and less human-legible =?UTF-8?B?Q2hyaXMgRXNwYcOxYQ==?=

As discussed in the comments and the other answer, this is an obfuscation technique. In this case, it's using "zero-width no-break space" characters (U+FEFF, aka ZWNBSP or BOM, represented in UTF-8 as 0xEF 0xBB 0xBF, which Unicode has deprecated in favor of word joiner, U+2060). According to that Wikipedia page:

Character U+FEFF is intended for use as a Byte Order Mark (BOM) at the start of a file. However, if encountered elsewhere, it should, according to Unicode, be treated as a "zero width no-break space".

| improve this answer | |
2

Ah, the character sequence is legitimately used to encode UTF-8 characters in internet headers, since they can contain only ASCII (rfc1342). Here however, is used to hide from spam filters, as Ghedipunk said in a comment.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.