1

Today I received an e-mail to my GMail account with just an image attached, empty subject and body. E-mail came from another GMail account, with SPF and other checks passed. Sender account differs from mine only in one letter, and that letter replacement made account's name unintelligible, so I guess it was created specially for that e-mail.

Unfortunately my e-mail software was set to display attached images, so attached image was rendered. It was a screenshot of a browser window with some strange website opened in it. It doesn't look like an advertisement to me. I uploaded an image file to VirusTotal and it didn't give me any flags.

I'm pretty sure it's some kind of an attack (as it doesn't look like a simple spam), but I cannot understand what kind of attack it is. The only thing that comes to mind is that they found a vulnerability in some JPEG rendering library and are now trying to use it. Are there other possibilities that I'm missing?

Full headers and mail: https://pastebin.com/b2U0upTL

UPD: It's really the full mail. I opened GMail's basic HTML UI to avoid previewing attachments, clicked "Show original", copied it, replaced addresses with and and pasted to Pastebin. There were no subject and no content other than attachment. If there was any other clue, I wouldn't ask here.

7
  • You provide only very few information about what you received. And these information are selected on what only you seem important and are already interpreted by you in a certain way. I don't think that the information here are sufficient to provide a reliable answer, i.e. everything is just pure speculation. Therefore I propose to close the question. Commented May 21, 2021 at 5:30
  • @SteffenUllrich I've tried to include all details, but maybe something is really missing. Could you please point out which information is missing? Commented May 21, 2021 at 20:26
  • The full mail (source code, including mail header) is missing. This would enable others to view all details and do their own interpretation. Commented May 21, 2021 at 20:37
  • @SteffenUllrich added Commented May 22, 2021 at 0:24
  • 1
    That's only a skeleton of the mail. Header is added but possible modified (i.e. subject stripped?) but the essential information from the body (i.e. the actual content) is removed. It is impossible to judge the content without having the content. Commented May 22, 2021 at 5:41

1 Answer 1

1

Yup, could be an exploit for a JPEG parser, maybe trying to exploit a known vuln in the Android jpeg parser, hoping you'll open the email on your phone.

Another possibility is that it's a "beacon" or "tracking pixel" and the act of loading the image from the remote server tells them that your email address is active, the time you accessed it, your IP address, etc. Although usually that's just a 1x1 pixel image; weird to put a full large image.

Not the answer you're looking for? Browse other questions tagged .