Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.
Sign up to join this community
While there is the possibility that this is just to prevent people from viewing offensive images against their will, somehow I don't think that's the reason why pretty much every email client defaults to making the user white list every single email address that sends them images. This level of paranoya screams "security feature" to me.
My question is: is it? And if so, what are the possible problems? Or is it something else entirely?
Several reasons:
The more content in the email that the client loads and interprets, the greater the possibility that the email will deliver a malicious payload. The relatively recent vulnerability in JPEG 2000 rendering code comes to mind -- merely displaying a malicious image could be dangerous.
Images in email are commonly used by spammers and marketers to determine whether or not you've opened an email. This implicitly also tells them whether the email was delivered successfully and whether the destination email address was valid (useful for spammers).
Depending on your mail platform, image downloads may tell the sender the user's IP address.
Image URLs can theoretically be used to attack a network from the inside. For example:
<img src="http://192.168.0.1/apply.pl?user=admin&password=admin&action=EnableRemoteLogin">
Hopefully an attack like the above would fail, but security folks prefer to limit exposure as much as possible.
I think there's two separate security risks that need to be addressed here:
Images which are actually in the e-mail. As some have touched on, there is inherently a direct correlation between the amount of content you allow your e-mail client to load and the attack surface of your computer while loading that e-mail. If you allow your system to load attachments automatically, it's much more likely that you may come across a malicious file that will compromise your computer.
Hot-links to remote content. This is most commonly what is being blocked when your e-mail client says something to the effect of "Click here to download pictures...". Once downloaded, these images may appear to be "in" the e-mail. But they are actually hosted on remote webservers. There's a few reasons you'd want to block these from automatically loading.
Obviously, your first concern is that the e-mail is a scam and the remote content is from a hostile source. Then, we're back to similar risks as with images which are actually in the e-mail.
As others have mentioned, this is something of a privacy compromise. Once your system contacts the webserver to download the remote content, a few things can be revealed to the host of that content:
It's also worth noting that the information available via knowledge of your IP address, and association of that with your e-mail address, could include:
Though some e-mail addresses inherently leak employer/ISP/location information, IP addresses can leak this information regardless of what is or isn't in your e-mail address.
All of the above bits of information could facilitate future exploitation of your system, or phishing attempts against you personally.
Another possibility to be aware of is that the remote webserver, while possibly being perfectly friendly on its face, could be compromised sometime between the e-mail being sent and you reading it. An attacker could then replace the remote content (which would otherwise be from a source you know and trust) with some of their own, which brings us again back to point number 1.
Malicious links to active remote content, as opposed to just static images, could do even more damage to your system. As @tylerl mentioned, an image tag may actually point to a malicious script or other content which could harm your computer or perform unwanted actions on your behalf. By restricting remote content from loading entirely, this is avoided.
Because retrieving the image from the server can reveal your IP address, which is considered a privacy issue. (The image can come from somewhere other than where the email originated, for instance.) It also validates your existence to spammers; they can tell the email has been opened when the embedded image is retrieved, and can pass identifiers back with it to tell which recipient opened it.)
It has more to do with security than taste.
There are exploits built into images and those can be used to attack computers. Thus if an image is coming from a less-than-trustworthy source, it should be blocked.
One point I didn't see covered (but may have been).
An image can appear to a user as if it is a page of text, but a spam or security filtering program will usually not be able to ascertain what it is that a user is seeing and responding to. This could be combated by suitably capable 'character recognition' software, but an image can be constructed to produce text which may fool many recognition programs.
The design decision to not load images automagically in e-mails probably dates back to when line speeds very variable and folks with slow line speeds (which even exists today) didn't want large image files being downloaded by default.
As a side note, I have a cousin who lives in the country with no cable TV and dialup speed on a phone line is the best he has at home. It is very very slow.
No doubt today higher line speeds are the norm, and it seems the default would have changed. No doubt the security concerns have prevented the default from changing.
