115

I would like to know why is it considered to be dangerous to open an email from an unknown source?

I am using Gmail and I thought it's only unsafe to download an attachment and run it.

The first thing that came into my mind was what if the email text contains XSS JavaScript code but I am sure that every email provider has protected their site from getting XSS-ed.

What is going on behind the scenes when you get infected just by clicking on email and reading its content, for example on Gmail?

techraf
  • 9,141
  • 11
  • 44
  • 62
Tomas
  • 1,331
  • 3
  • 10
  • 10
  • 42
    In the case of HTML email, csrf could be also used. eg : `` – Xavier59 Sep 05 '16 at 10:05
  • 3
    One would also assume that opening an email increases the risk of a link being click or a file being downloaded since you cannot do these things without first opening the email. – Deleuze Sep 05 '16 at 13:04
  • 13
    Even if the xss xavier mentioned does not work, the attacker could verify the email using and you could get into the focus of massive spamming + bruteforcing – Jonas Wilms Sep 05 '16 at 14:53
  • 2
    You should never open an email as HTML. Always read it as plaintext only first, to avoid all those kind of attacks. If it is an HTML email you can have a glance at the contents and check whether they could be safe... – Bakuriu Sep 05 '16 at 17:02
  • 64
    Better yet, just don't read your email at all. It's always full of distracting requests that take time. :P – Peter Cordes Sep 05 '16 at 22:35
  • 10
    Back in the day, Eudora Pro would download and save to disk every attachment in every email one received (not even opened, just received). I once was hired by the defense team for a middle school principal accused of viewing inappropriate content at work. Every single image with nudity on his drive turned out to have been auto-downloaded by his email client. – Charles Duffy Sep 06 '16 at 14:57
  • 38
    @Xavier59 if you use an online banking service that sends payment information over GET requests, you have bigger security issues in your life than weird emails. – user2752467 Sep 07 '16 at 00:21
  • 1
    @JustinLardinois And without any kind of password or two-step authentication before sending money xD – Kevin Sep 08 '16 at 09:25
  • @Xavier59 does turning images off in GMail (not in the browser) not protect against that? – MauganRa Sep 10 '16 at 14:23
  • 1
    @MauganRa Yes, it will protect you against this kind of attack in email. Howewer, you are still vulnerable on every sites you visit you can't trust (or website that has been compromised). See how it works : https://www.owasp.org/index.php/Cross-Site_Request_Forgery_(CSRF) – Xavier59 Sep 10 '16 at 14:59
  • 2
    For the answer to this question, please check the attachment I included with my recent e-mail to you... – WBT Sep 11 '16 at 15:58
  • 1
    Is it less dangerous to open an email that isn't suspicious? – gnasher729 Sep 11 '16 at 21:11
  • Not sure if its possible with gmail, but you can leak NetNTLM hashes with Outlook https://wildfire.blazeinfosec.com/love-letters-from-the-red-team-from-e-mail-to-ntlm-hashes-with-microsoft-outlook/ – n00b Apr 30 '19 at 13:30

9 Answers9

207

There is a small risk of an unknown bug — or a known but unpatched one — in your mail client allowing an attack by just viewing a message.

I think, though, that this very broad advice is also given as a defense against some types of phishing scams. Social engineering attacks are common and can lead to serious trouble. Making sure people are at least suspicious is a first line of defense. It is like telling an elderly grandparent to never give their credit card info over the phone — okay, sure, there are plenty of circumstances where doing that is relatively safe, but when they keep getting scammed over and over, it's easier to just say: don't do it.

Likewise, not opening mail keeps you from reading about the plight of an orphan in a war-torn region who has unexpectedly found a cache of Nazi gold and just needs $500 to smuggle it out and they'll share half with you, and your heart just goes out, and also that money wouldn't hurt.... Or, while you know the rule about attachments, this one says that it's pictures of the cutest kittens ever, and how can that be harmful — I'll just click it and okay now there are these boxes saying do I want to allow it, which is annoying because of course I do because I want to see the kittens....

mattdm
  • 2,731
  • 1
  • 15
  • 17
  • 60
    Love the last paragraph! – Lukas Sep 05 '16 at 15:53
  • 91
    Oh, and BTW, you also need to upgrade your video codec before you can see that little doggy video. –  Sep 05 '16 at 19:25
  • 43
    Just hop on over to the Personal Finance StackExchange site and gasp in awe at the "Is this a scam?" questions people ask about there. (And then imagine how many people *don't* ask that question.) – Jörg W Mittag Sep 07 '16 at 15:12
  • 3
    You might want to also mention that if viewing HTML mail your email client may invoke your browser or some other external program such as the Flash plug-in to show you the email (with all the security holes those programs have). Some emails may also embed web-bugs where pulling a picture embedded in the email tells the sender that you actually viewed the email (and when) because the unique URL the embedded picture was at was accessed then. Knowing someone looked at their email makes you an actual person and puts you on the prime list for future spamming. – Mark Ripley Sep 08 '16 at 10:14
  • This advice also applies to unknown QR codes. :) – mattdm Feb 14 '22 at 14:24
61

Not for gmail, but for Outlook there have been a number of "preview pane" exploits where simply looking at the email is enough to compromise: Can malware be activated by previewing email in Outlook's Preview pane?

Community
  • 1
pjc50
  • 2,986
  • 12
  • 17
  • 26
    Anything that renders HTML email via some web browser engine is vulnerable to the same exploits the HTML engine and the media rendering libraries it uses are vulnerable to. – rackandboneman Sep 06 '16 at 10:37
  • 4
    There are a couple still unpatched ones in Kontact/KDEPIM/KMail, too… ☹ – mirabilos Sep 06 '16 at 19:10
30

Even if nothing actively bad happens, many passively bad things can happen -- for example, you might view a one pixel transparent image tagged with your email address that flags you as the kind of person who opens and reads suspicious email. Those are lists that you don't want to be on.

arp
  • 531
  • 3
  • 5
  • 7
    I thought every decent mail client was blocking inline images already? – John Dvorak Sep 05 '16 at 21:44
  • 1
    @JanDvorak Actually I noticed that recently, some clients stopped doing this. Also my client in particular never blocks external FLASH components. It's really crazy. – Tomáš Zato - Reinstate Monica Sep 06 '16 at 08:46
  • 9
    Gmail added image proxying so that you don't make the request directly to the original server: https://gmail.googleblog.com/2013/12/images-now-showing.html This doesn't stop individual tracking (ie, sending the user to example.com/images/example-at-gmail-dot-com.png and noting that it gets hit) since the proxy/cache apparently doesn't actually download the image until the user does. It just does the download once, and scans the image, but the attacker will still see you opened your e-mail. – Kevin Fee Sep 06 '16 at 16:44
  • 4
    Ah crap, I didn't know about that one. I always open them just to see what those people are up to now. I kind of enjoy reading their stories. Always cracks me up when I have another millionaire uncle or some prince of a non existing country wants to visit me. – miva2 Sep 07 '16 at 14:14
  • 2
    @miva2, search YouTube for "Scamalot"; you'll have a lot of fun. The best one is "Toaster." :) – Wildcard Sep 09 '16 at 20:27
  • @JohnDvorak Apple mail doesn't seem to block by default. (iOS and macOS) – JBis Dec 24 '20 at 17:09
14

Take the example of Gmail. Incoming email is pushed through mail filters, or milters. Each of these milters assesses the email based on characteristics. For example, sender status, SPF, DKIM, domain reputation, greylist, spamlists, contents, etc.. If the mail is not already rejected at this point, it will reach the antivirus scanner.

The scanner simply detaches the files in the mail content, and matches them with virus definitions. In the case of Gmail, archives are also unpacked to scan individual files. When no threats are found the email will be stored in your email folder.

However, this works great but Gmail cannot protect you from all threats. Strange compression formats or encrypted files can still slip through. XSS is highly unlikely because these type of exploits are recognized quite fast, either by Gmail or the browser. The best chance of infection is though a local mail client using extensions (eg. CVE-2015-6172) to load attached content.

D.W.
  • 98,420
  • 30
  • 267
  • 572
Yorick de Wid
  • 3,346
  • 14
  • 22
  • 4
    I did not know they were called milters. – David says Reinstate Monica Sep 05 '16 at 13:14
  • 1
    @DavidGrinberg https://en.wikipedia.org/wiki/Milter I believe Sendmail coined the term. – Yorick de Wid Sep 05 '16 at 13:22
  • 24
    This doesn't answer the question. The OP wants to know if/why it's unsafe to simply open the email (i.e., view the message in his browser). He specifically says he's *not* asking about why it would be unsafe to open attachments. –  Sep 05 '16 at 14:55
  • 2
    How do the Google virus definitions compare to products such as AVG, Norton, McAffe etc.? Since Gmail is free, I kind of assume their virus definitions are "bare bones" and if I want better protection have to purchase a product? – BruceWayne Sep 05 '16 at 17:30
  • 2
    @BruceWayne We have no idea. They could rely on third parties to deal with this, or have their own database (more likely knowing Google). This topic took Gmail as an example, but I expect Outook.com to use something very similar to Windows Defender. – Yorick de Wid Sep 05 '16 at 17:42
  • 1
    @BruceWayne: I am quite certain Google doesn't want to be storing viruses in their systems, even if you never open your mail – Mooing Duck Sep 05 '16 at 18:33
  • 2
    @MooingDuck Your comment doesn't make any sense. No one is storing viruses, BruceWayne asked about virus *definitions*, which is just a pattern. – Yorick de Wid Sep 05 '16 at 18:38
  • 5
    @YorickdeWid: Where do you think the emails are stored? If Gmail receives an email, Google will scan it for viruses _partially to keep Google servers from being infected_. Then they store it, and you can then read your emails. – Mooing Duck Sep 05 '16 at 18:40
  • Google compared to antiviruses has more chance to monitor web traffic (it's ok, they see what you type in "Search box" nothing to be warned about) and hence may more effectively detect suspiciouse behaviours that could be attributed to viruses. That allow them to detec menaces even without virus signatures in a database. At least thats how every antivirus company try to achieve with what they call "Cloud protection". But compared to antivirus companies, Google has much more users from which mine data – CoffeDeveloper Sep 12 '16 at 09:16
  • 2
    @BruceWayne just because Gmail is free to us doesn't mean they are NOT making tons of money from people using it! And I think that is the answer, Gmail virus scanners are on par with the ones in your list because they have a financial incentive to make them as good as they possibly can :) – xxx Nov 18 '19 at 14:51
8

Generally it should be safe to view an email, but software is complex and very rarely perfect.

Although good software makers will try to make sure they display all emails in a safe way they have certainly made mistakes. When these bugs are discovered people will send crafted emails that exploit the bugs in some way and may install malicious software on your computer or do other unpleasant things.

A new bug could be discovered today in either Gmail or the web browser you use, and someone might send an email that exploits that bug before you get an update that fixes the bug.

The danger increases substantially if you use an old or unmaintained web browser or email client.

bdsl
  • 595
  • 3
  • 7
4

There are ways to know you opened an email (for example, Mixmax is a Chrome's extension which tracks emails sent via Gmail by embedding a 0 length hidden image in the email's body).

Even when you do not allow images to be loaded automatically (when in Gmail you see at the top of the email a link with "Display images below"), if HTML is loaded, you're allowing possible exploiters to know you're reading them, which is a go-ahead for email-spam bombardment.

Therefore, answering the "why" question with another question: is it risky to open and load an unknown email with embedded HTML in it?

YES, just by opening an email in Gmail you may be sending data to potential attackers.

Other email clients that do not thoroughly block images of opened emails will also send the data when you open them.

CPHPython
  • 321
  • 1
  • 9
  • 2
    How does Mixmax know when you read the email? – KSFT Sep 11 '16 at 03:45
  • 1
    Gmail proxies images when they are received, so mixmax would _not_ work. – ave Sep 11 '16 at 17:41
  • @KSFT give it a try and test sending an email to a Gmail account and then open it through Gmail. You can click the little down triangle at the right and then "Show Original". Search for `3D""` The `...` part has the tracking ID that is used to identify your account and your email, once you open the email this `` is loaded and that URL is accessed and thus registering the respective data in their DB. – CPHPython Sep 12 '16 at 10:13
  • @ardaozkal Well, just try it out instead of commenting "*would not* work". Mixmax does work, even when Gmail is blocking the images. This type of technology has been around for quite some time and analytics systems use it often (Facebook and Google). Unless you have another sort of plugin that blocks all of it, you will always be tracked once you open an email through a client that allows these embedded kind of images to be loaded. – CPHPython Sep 12 '16 at 10:20
  • @CPHPython I would try, but I don't use gmail. – ave Sep 12 '16 at 11:05
  • @ardaozkal and yet you are commenting on how Gmail works... If you are really curious about it, just create a couple of Gmail accounts, try it and then delete them. – CPHPython Sep 12 '16 at 11:09
  • @CPHPython I have an account that I used to use and that was the case. I stopped using it last year/ – ave Sep 12 '16 at 11:23
2

Malicious links account for a majority of exploitation today. Malicious code (javascript mostly) is specially crafted to execute unwanted code via your browser. Just last week we saw the 3 iOS 0-days (see Trident/Pegasus) which started from a malicious email and possibly has been in the wild since 2014 (from security now) These links were even "one time use" links, had support for every iOS since 7, and was able to "jailbreak" the iOS remotely. My point is, I wouldn't worry about the actual "content" of the message so much as clicking on images or links in the email. While yes, there are tricks to loading scripts via image loading (or the like), modern browsers and emails clients have the ability to prevent scripting, so you can just turn that off. Solved.

archae0pteryx
  • 131
  • 3
  • 2
    So what is you actual answer to the question? Is it dangerous to just open the mail? Or only dangerous if you click anything? Those are interesting examples, but the very end of your answer seems to imply that you think opening mails should be safe (if a client is configured correctly?) – Peter Cordes Sep 05 '16 at 22:37
  • Directly, yes that is what i am saying. Configure you're mail client to not load remote content and you will be as safe as you can be however, like i said, the real problem is clicking a link. – archae0pteryx Sep 06 '16 at 01:24
  • 1
    My point was that you should [edit] your answer to state your overall conclusion more clearly. I'd also suggest breaking it up into separate paragraphs. (I know, short paragraphs feel like they're too short, but sometimes they only need to be one sentence) – Peter Cordes Sep 06 '16 at 01:34
  • @PeterCordes. I do appreciate the comment. I am new at this. (obviously) so thanks! – archae0pteryx Sep 06 '16 at 15:50
  • 1
    I don't think that "as safe as can be" is true, since as other answers have pointed out, there have been plenty of preview-pane exploits, image-viewing exploits, etc. This feels like bad security advice, advocating bad security practices. – Dewi Morgan Sep 06 '16 at 18:16
  • Not loading remote content does exactly what the name suggests. – archae0pteryx Sep 07 '16 at 20:48
  • So the answer is "yes it can be dangerous if scripting is turned on, so turn it off"? – Warren Dew Sep 09 '16 at 16:01
2

The reality is that programs process data. These programs may contain bugs causing the program to behave completely differently than intended. Usually what happens in such circumstances is that the program will either be terminated by the operating system or just engages in random non-harmful behaviour. However, everything a program does is technically still deterministic (unless randomness is involved) - so what a program actually does when encountering data it processes wrong is deterministic thus attackers are able to construct data in a way to control exactly what the program does.

When receiving e-mails, your e-mail client is already processing data, so there's a good chance that an attacker can gain control of your e-mail program just by sending an e-mail to you - no matter if you actually look at it. The e-mail program will download the e-mail and, for example, display the Subject to you. When you open the e-mail, your e-mail client will likely do even more things, such as parsing the HTML in the e-mail, displaying the contents, displaying images etc. In everything it does (from parsing HTML, to rendering images, to rendering text, to downloading e-mails, to display the Subject), there can be a bug in it.

Opening a suspicious e-mail is only riskier because more stuff is processed when you actually open it.

When you visit a website (such as Gmail) and open an e-mail there, things are vastly different because Gmail is just a website like any other... except it displays e-mails. The issue there is that websites need to take into account that you can't just send the content of the e-mail raw to the browser because then there could be malicious HTML and/or malicious JavaScript in it. Technically this isn't too much different from sites like Wikipedia where users can write articles that contain formatting.

Of course, your browser will also use libraries to render text, process fonts, process images etc. so if there's a bug in an image library and the e-mail contains a malicious image then you're out of luck and it's not Gmail's fault. You can expect that the possible security vulnerabilities with Gmail are the same as the browser's, plus the issue of XSS and other web-specific security vulnerabilities.

This is also the reason why you'll get infected with stuff even when you don't visit any suspicious sites (and people usually mean porn, streaming, warez sites by that) is because even non-suspicious sites serve ads from different networks, so if an attacker infects an ad network somehow even the non-suspicious sites will serve you malware. Technically it's insecure to use third-party content you don't control. Think about what happens when an attacker manages to control a CDN that serves jquery or bootstrap or whatever, where thousands of sites are using it. Then all these sites will contain malicious javascript. To prevent that from happening there's SRI but I don't know how well supported that is as of now.

schroeder
  • 123,438
  • 55
  • 284
  • 319
mroman
  • 555
  • 3
  • 9
1

Opening a suspicious e-mail is only riskier because more stuff is processed when you actually open it. For example processing that can:

  1. track your IP

  2. perform XSS / CSRF / Command Injection if website is vulnerable.

  3. or in an advanced attack process a backdoored exe to gain terminal or root

xxx
  • 167
  • 8
chitnan
  • 79
  • 4