3

I was looking through my spam folder, and there's a 100% sure spam email, that asks me to confirm that I want to unsubscribe by clicking some big unsubscribe button. That button is simply a mailto: link, similar to the one below

mailto:[email protected];[email protected];[email protected];[email protected];[email protected];[email protected]?subject=Unsubscribe

There are no images in the email, so no pixel tracking.

What is the attack here?

Is the attacker's hope that I would click on the mailto link, and then click send, and then they'd know that my email address is of a gullible person, so they'd better prioritize their real spamming resources, or is there more to it?

I find the above attack odd, because it puts quite some burden on the attacked. I need to ignore the fact that I never subscribed to require clicking on unsubscribe, then I need to click on Unsubscribe, then the mailto: protocol needs to be correctly associated with whatever I use for email, then I also need to click send, then the email client would ask me to confirm that I want to send a message without any content, then I would either confirm, or actually write some text in the content, and then the message would be sent, and the attack would be successful. That's a lot of work and I can change my mind at any time in this process and the attack would be unsuccessful.

Can a mailto link be somehow exploited?

2 Answers 2

4

Aside from the rare direct mailto-related exploit (H/T @nobody), an attacker learns what your preferred email identity is when you use an email reply or mailto. Perhaps they got to you through a list or a forwarding address (if you're like me, you customize addresses to services so you can track how your address is shared).

An actual email reply says you're a real person, verifying and/or revealing a new address to the attacker.

It's also likely a ham indicator for some anti-spam systems. The unsubscribe model by systems like (iirc) Microsoft's requires mailto:, which may help tip spam into a bulk designation instead of a junk folder.

3

Is the attacker's hope that I would click on the mailto link, and then click send, and then they'd know that my email address is of a gullible person, so they'd better prioritize their real spamming resources, or is there more to it?

Pretty much this. And not so much that there's a gullible person, but that there's a person, an indicator that the email address is valid and being read by a human. Attackers usually send to valid and invalid email addresses both, and being able to determine which ones are valid is useful information.

Can a mailto link be somehow exploited?

There have been a small number of exploits tied to mailto links, all old at this point. As a general rule mailto links can be considered safe. Their primary threat vector is information disclosure; as discussed above, they lead to sending mail out.

2
  • 2
    "all old at this point" - there are three mailto cves in 2020. Not too old to try... Although none are related to the OPs scenario
    – nobody
    Jul 30, 2020 at 14:06
  • The mailto?attach=/etc/passwd... in CVE-2020-11879 is pretty awesome in its simplicity! Jul 30, 2020 at 14:11

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .