1

I was looking through my spam folder, and there's a 100% sure spam email, that asks me to confirm that I want to unsubscribe by clicking some big unsubscribe button. That button is simply a mailto: link, similar to the one below

mailto:user@inactivedomain.com;someotheruser@gmail.com;moreusers@mailbox.org;etc@inbox.ru;etc@list.ru;etc@bk.ru?subject=Unsubscribe

There are no images in the email, so no pixel tracking.

What is the attack here?

Is the attacker's hope that I would click on the mailto link, and then click send, and then they'd know that my email address is of a gullible person, so they'd better prioritize their real spamming resources, or is there more to it?

I find the above attack odd, because it puts quite some burden on the attacked. I need to ignore the fact that I never subscribed to require clicking on unsubscribe, then I need to click on Unsubscribe, then the mailto: protocol needs to be correctly associated with whatever I use for email, then I also need to click send, then the email client would ask me to confirm that I want to send a message without any content, then I would either confirm, or actually write some text in the content, and then the message would be sent, and the attack would be successful. That's a lot of work and I can change my mind at any time in this process and the attack would be unsuccessful.

Can a mailto link be somehow exploited?

3

Aside from the rare direct mailto-related exploit (H/T @nobody), an attacker learns what your preferred email identity is when you use an email reply or mailto. Perhaps they got to you through a list or a forwarding address (if you're like me, you customize addresses to services so you can track how your address is shared).

An actual email reply says you're a real person, verifying and/or revealing a new address to the attacker.

It's also likely a ham indicator for some anti-spam systems. The unsubscribe model by systems like (iirc) Microsoft's requires mailto:, which may help tip spam into a bulk designation instead of a junk folder.

2

Is the attacker's hope that I would click on the mailto link, and then click send, and then they'd know that my email address is of a gullible person, so they'd better prioritize their real spamming resources, or is there more to it?

Pretty much this. And not so much that there's a gullible person, but that there's a person, an indicator that the email address is valid and being read by a human. Attackers usually send to valid and invalid email addresses both, and being able to determine which ones are valid is useful information.

Can a mailto link be somehow exploited?

There have been a small number of exploits tied to mailto links, all old at this point. As a general rule mailto links can be considered safe. Their primary threat vector is information disclosure; as discussed above, they lead to sending mail out.

2
  • 2
    "all old at this point" - there are three mailto cves in 2020. Not too old to try... Although none are related to the OPs scenario – nobody Jul 30 '20 at 14:06
  • The mailto?attach=/etc/passwd... in CVE-2020-11879 is pretty awesome in its simplicity! – Esa Jokinen Jul 30 '20 at 14:11

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.