Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.
Sign up to join this community
I'm using macOS High Sierra, and mac Mail version 11.3. I have a script that uses the Twitter API to continually fetch tweets in real-time and send the contents of each of these tweets, including any images, to myself in an html-formatted email (such that any images would be embedded in an <img> tag).
If I read all of these emails using mac Mail, is there any way I could get some kind of virus, trojan, or other malware onto my computer?
Twitter's images should be safe from attacks.
While it is technically possible for an attack to be embedded in an image, you're far more at risk with everyday email and web browsing. This would require some sort of very serious and extremely unlikely exploit in your system's image renderer.
You're a little safer with Twitter than arbitrary emails' images or images from other websites because Twitter reencodes most images that are uploaded to it, which means it'll coincidentally remove most non-image data (likely including an exploit's payload), plus I presume they also scan for malware. They'd almost certainly introduce such scanning after such an unlikely attack is documented.
The only even remotely-related item I can think of is this series of polyglot file proofs of concept like appending DEFLATE (.zip) data to a PNG image and keeping it compact enough to avoid Twitter's reencoding logic, but all of those require manually telling your software how to reinterpret the file.
I believe you'd have to go back a few decades to find any sort of exploit coming from an image.
