6

I routinely get spam messages which state "Your account for [Insert game here] has been flagged. If you don't click this link/send us this info/go to this website in the next 72 hours, your account will be banned." I know that mails like this are pure spam, since the usual action the makers of these games do is ban first and ask questions later. I just delete them without clicking any links inside

However, I have the Outlook preview pane open, which shows a preview of the mail next to the list of emails. Can a crafty spam creator somehow hide something in this mail which could have a negative effect on my computer's health? something like a keylogger, a trojan or full-blown malware?

Assuming a fully patched version of Windows, Office 2013 and Norton 360, can someone hide malware in a message without an attachment but with embedded images?

  • Possible? Yes. In this case, likely? No. – Adi Mar 24 '14 at 17:11
  • Not malware but if your client is configured to load remote images, the attacker will know that your email is valid because he will get a hit in his logs. – Joan Charmant Mar 24 '14 at 18:04
  • This applies to Outlook 2010, but goes to show that it's certainly possible given the proper circumstances : community.webroot.com/t5/Security-Industry-News/… – DKNUCKLES Mar 25 '14 at 0:05
5

Malware in an email can theoretically compromise your system even if you don't open it. Every mail that comes in is processed to some degree, and vulnerabilities in the email program could be used my embedded malware. This has happened in the past IIRC, several years ago, and I believe it had to do with image processing.

Currently there are no published vulnerabilities in outlook that could lead to a compromise as you describe that haven't had a patch released. That does not mean there are no zero day vulnerabilities that are being used quietly, or have yet to be discovered.

1

Over the years, Microsoft has done a lot to make it harder to exploit Outlook out of the box, however, any system that processes data from untrusted sources is open to being exploited. There are many potential vectors for this, particularly if you grab additional content for messages beyond the basic text.

It's impossible to guarantee you computer couldn't be infected with malware simply from being connected to the Internet, let alone having Outlook installed or viewing messages in it. Your best bet is to not open mail from suspicious senders, keep your system patched and up to date and run virus scanning software. It's also worth noting that a fair number of ISP's do virus scanning server side before delivering e-mail. If your e-mail service provider does not do this, it may be worth using a provider that does, however the threat is still likely pretty low unless you have a reason to be targeted.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.