Can someone know my IP address through Thunderbird email attachments?

Question

Can someone know my IP address through Thunderbird email attachments?

Can a cunning attacker manage to find my IP address through attachment 'images' in emails that I unsuspectingly open?

Answer 1

It depends.

Assumption: by 'attachment image' you mean a HTML e-mail with embedded images that load from a remote location. In this case, if your Thunderbird client is set to automatically load images in e-mail, the answer is yes - an attacker controlling a web server can see where the connection came from.

On the other hand, if an attacker just sends you an e-mail with an image, then the answer is no. However, if the "image" is in fact not an image file but a carefully crafted file that crashes your image viewer in a way that allows the execution of code, then it's a different story. In this case the answer is obvious and the disclosure of your IP is likely your least concern..

Of course, if you're behind a NAT or other forms of routing, the attacker might see the public IP of your internet connection. Also, their e-mail might be opened by a mail server with a policy of caching images first, or a proxy might intercept and open your GET request for an image.

UPDATE By default Thunderbird does not load images:

By default, Thunderbird blocks remote images and other content in messages from people you don't know. This protects your privacy because spammers can verify your email address by detecting if you viewed a remote image in a message from them. Its also possible to embed an executable (malware) in images. When you receive a message with remote images, Thunderbird will display an alert stating that remote images have been blocked, and the images in the message body will be replaced with simple place-holders (screenshot). If you do want to view the remote images—for example, if you subscribe to an e-mail newsletter that regularly includes remote images—all you need to do is click the "Show Remote Content" button that appears to the right of the alert message. Older versions of Thunderbird used different names for that button such as "Show Images" or "Load Images".

(source)

Answer 2

Yes, they can, and they don't even need to be especially cunning to do so. But you can prevent it.

When you receive an email in HTML format, the emails HTML code can embed images from an external webserver. Many email clients (not just Thunderbird) will then connect to that webserver to download the image. That way the webserver will learn your IP address. When the sender sends a mass email, they can embed an unique image URL in each individual email. That way they know if, when and from which IP address each email was opened. This is very useful for spammers, because it allows them to measure the success rate of their spam filter prevention measures and identify email addresses with a high view-rate so they can send them even more spam.

You can prevent this in Thunderbird under Tools->Options->Advanced->Privacy->Block loading of remote images. You will then no longer see images embedded in HTML emails which are not attached to the email themself, but most emails of that kind are spam anyway.