Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.
Sign up to join this community
I've started using Sidekick to know when an email is opened or one of the links in it is clicked. What I ask now is how to know if an email I received is provided with a similar tracking system.
With Sidekick, every link is changed (to something like www.sidekick.com/abcdefg123), so that's the easy point. The difficult (to me) one is the tracking one. What is more, is it possible to know an email is being tracked before you open it?
How it works: Picture a pipe. The pipe has a huge variety of valves and possible turns (blocked off by more valves), and information flows to and from a variety of points. The pipe is the internet, and, in some cases, your e-mail providers. Your spy is trying to get you to open a valve to a point HE controls so he can tell when you read his e-mail, so he exploits the system. When most users would send something like "here, look at picture x (picture x file)!"* Your attacker sends "here, come and get picture x so you can look at it (link to picture x)!"** To get picture x, you have to open the valves to your attacker's 'point.' When you do that, he knows that you read the e-mail, but he can also determine where you are (your IP, and from that, your physical location), your OS, and your browser. An attacker might make the entirety of his e-mail picture x, in which case he can change the e-mail even after he sends it.
So, how would you stop this? Well, not easily. If you know who your attacker is, it's an easy matter to block content from his IP or web address, but most web-based clients download pictures automatically, and you can't scan e-mails that aren't ON your computer. I like @LateralFractal's idea of rendering only plaintext, if your provider offers it. Basically, for web-based e-mail, it all comes down to "what does your e-mail provider do to stop this?" Usually, the answer is "not too much." Sorry.
Of course, your attacker could also send you something like "COMMUNITY ALERT: HAVE YOU SEEN THIS PERSON? THE POLICE ARE OFFERING A $5000 REWARD FOR HIM. SEE HIS MUG SHOTS HERE: www.badwebsite.com". Then, by clicking on the link, you open up the pipe to the spy without his having to do any work at all!
*all this results in is you seeing picture x, all of the "words" are parsed by the e-mail client and turned into something readable
**still results in you seeing picture x
You can't necessarily know if an email you receive is designed to be tracked but as tracking is limited to certain techniques, you can infer a higher probability of this behaviour if the email seems tailored towards such an end:
Email includes images that need to be downloaded remotely
Typically an email can have all images and formatting stored internally inside a multipart mime type container. So if an email doesn't do this and refers to external images that your email client must download then this might be an email with a web bug in it.
A web bug is any remote resource that the email client is encouraged to download for displaying the email; such that downloading it proves that the email was opened by the recipient. These can be 1x1 transparent GIFs that have a unique URL, such as http://spy.server/email-1234567890abcdefg.gif
Good desktop email clients will not download external images automatically without your permission to avoid this privacy risk. Webmail services may not provide this feature.
Email lacks some or all of its pertinent information, requiring online access
This isn't necessarily a bad thing, as banks will require you to login to their website to discourage phishing. But any hyperlink in an email can be used to track you if you click on it.
You may not know that an email is being tracked before you open the email unless your email client has fancy anti-malware features. The simplest approach is to set your email client to only render emails as plaintext. This gives you the opportunity to decide if the email looks legit and whether you trust the sender sufficiently to switch to HTML rendering on an as-needed basis.
