5

I've noticed that the subject in one of the spam emails looks like this in source:

Subject: Offe=?UTF-8?Q?=EF=BB=BF?=r fr=?UTF-8?Q?=EF=BB=BF?=om C=?UTF-8?Q?=EF=BB=BF?=redi=?UTF-8?Q?=EF=BB=BF?=t On=?UTF-8?Q?=EF=BB=BF?=e Ba=?UTF-8?Q?=EF=BB=BF?=nk=?UTF-8?Q?=EF=BB=BF?==?UTF-8?Q?=EF=BB=BF?=

but in web it looks normal

Offer from Credit One Bank

The only thing I recognize is 0xEF, 0xBB, 0xBF, which is the UTF-8 BOM.

Which interpreter recognizes this character sequence =?UTF-8?Q?=EF=BB=BF?= ?

Is there a vulnerability around email subjects? What are they trying to do?

Improve this question
2
  • 3
    They're trying to obfuscate the email from being detected by spam filters.
    – Ghedipunk
    Jul 11, 2019 at 18:10
  • 2
    Rather than editing your answer into your question, you should self-answer.
    – anon
    Jul 11, 2019 at 19:24

2 Answers 2

Reset to default
4

This is called quoted-printable formatting and it is required in email because RFC 5322 (.eml, originally RFC 822) explicitly allows only ASCII characters, so RFC 2047 presents an "ASCII-armor" (to borrow a term from PGP) format to encode non-ASCII text as either quoted-printable or base64.

This is formatted like =?CHARSET?ENCODING?CONTENT?=

Quoted-printable is particularly useful for when the content is mostly ASCII, so for example Chris España could be encoded as =?UTF-8?Q?Chris=20Espa=F1a?= rather than base64's longer and less human-legible =?UTF-8?B?Q2hyaXMgRXNwYcOxYQ==?=

As discussed in the comments and the other answer, this is an obfuscation technique. In this case, it's using "zero-width no-break space" characters (U+FEFF, aka ZWNBSP or BOM, represented in UTF-8 as 0xEF 0xBB 0xBF, which Unicode has deprecated in favor of word joiner, U+2060). According to that Wikipedia page:

Character U+FEFF is intended for use as a Byte Order Mark (BOM) at the start of a file. However, if encountered elsewhere, it should, according to Unicode, be treated as a "zero width no-break space".

Improve this answer
3

Ah, the character sequence is legitimately used to encode UTF-8 characters in internet headers, since they can contain only ASCII (rfc1342). Here however, is used to hide from spam filters, as Ghedipunk said in a comment.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .