11 ms·
Kobold letters: HTML emails are a risk
- eviks 3y ago> the position of the original email in the DOM usually changes, allowing for CSS rules to be selectively applied only when an email has been forwarded. oh, that's sneaky. Would "plain" old rtf have been a better choice for formatted emails since that CSS complexity isn't much needed outside of spam marketing :) Why has that been surpassed by HTML&CSS
- lesserknowndan 3y ago[flagged]
- bluetidepro 3y ago> “However, you are still not convinced, so you call your manager to ensure that the email is legit. He confirms, so you transfer the money.” I feel like it’s a HUGE (silly) assumption you’d ask generically “did you send this email” instead of something more specific like “do you REALLY want me to transfer you money like this?” to which the manager would obviously be confused and the attack would likely be killed in that conversation. This is an interesting attack vector but I am questioning how likely it is to succeed. The article paints a very specific and narrow window of events for this attack to really work. I don’t buy it, personally. EDIT: I know phishing happens and works. I am not saying it doesn't. I just mean the people that fall for phishing don't need this sophisticated of an attack to fall for. In fact, the attacker probably narrows the chance of success by putting this much extra (very specific) effort into the attack. They are likely to just succeed with their typical phishing email.
- Macha 3y agoWorked for a 10,000 person company, 50% engineers. There'd be several cases a year of someone using the company credit card to buy gift cards for "the CEO" or other senior execs whose details are available on linkedin or corporate sites, despite that exact case being the example in the anti-phishing training. So you'd be surprised.
- bluetidepro 3y agoI don't doubt phishing happens. I just think this specific scenario/technique is one that is probably extremely rare. The attacker likely wouldn't put this much extra effort/thought in when their basic attacks already work, like you're describing.
- fkyoureadthedoc 3y agoSecurity at my job pumps their numbers by pretending you fell for a phish if you click the link in their obvious phishing test emails. I clicked one to see how good of a job they did at the other end of the link trying to extract whatever they want from me, but there's nothing there! So lazy.
- hk1337 3y agoI got dinged once for using curl (in a VM) on the link get the details to pass one when I reported it.
- npongratz 3y agoI once got dinged for forwarding an obvious gotcha email, without ever opening it, to our security team's phish notification address, as our employee handbook instructed. I learned my lesson.
- testudovictoria 3y agoI once got dinged for not reporting. I saw an email that was clearly an internal security campaign. I deleted it. I received an email a day or two later stating that I failed to take action on a phishing attempt. Damned if you do; damned if you don't.
- Macha 3y agoFor a while I had a thunderbird filter to automate forwarding based on our provider's email header. They disabled SMTP and the Gmail web client has no such ability to filter on arbitrary email headers.
- mmsc 3y agoYou’re right. They wouldn’t ask any questions at all, and just send the money.
- bluetidepro 3y agoAgreed, the people falling for this would already fall for a much more basic phishing attempt. Thus, the attacker has no need to put this much extra effort/thought into it.
- themoonisachees 3y agoThis doesn't even need to be a hypothetical. We know that the attacked currently do not need to do this, because they don't. Darwin's law is very much in effect for scams of all types.
- croes 3y agoCould be a link to some kind of portal. You ask your boss if he sent the link to the portal, he confirms, they change the link to a phishing site.
- nkrisc 3y agoMy gut says this could be more effective. After all, the initial “phish” (the innocent looking email the manager receives) isn’t fishy at all, and unlikely to trigger any concern. Once the stakes are raised and the scam is revealed, the email has already been granted some amount of legitimacy. Sure, it can easily fail (“did you really want me to wire money to Cyprus?”), just as any phishing email can. But by bypassing the initial phishing filters of the recipient’s awareness, I could see it having a higher success rate than a cold phish that leads immediately with the scam. No evidence or knowledge either way, just a hunch.
- duxup 3y agoI agree that his seems so specific that while it is very interesting from a technical perspective, it is also much less likely compared to most phishing.
- dimask 3y agoI think that, in theory, it could allow for more sophisticated and targeted attacks, like changing the intended recipient of a money transfer. That would be much harder to detect.
- chromanoid 3y agoIt depends on the people I guess. Some managers will be annoyed of such conversations when they have to approve payments like that on multiple occasions a day - so employees might want to avoid such conversations. The attacker could even add something like that: "I am currently on a trip. If you are unsure call me on my private mobile phone number..." and then respond with a faked voice. I think a good way of reaching targets would be a "double" forward. So the sender assumes the role of an employee forwarding the email of a manager to an administration adjacent employee. This employee unsuspectingly forwards the seemingly harmless mail (that seems to be forwarded from the manager) again for a reason like birthday wishes or sick notice. This will make it hard for the actual target to understand where the email originally comes from. Beside that one can easily think up more creative ways to use this "feature". E.g. letting unsuspecting persons forward problematic content and then blackmail them etc.
- bambax 3y ago> I just mean the people that fall for phishing don't need this sophisticated of an attack to fall for Yes. It's more of the opposite. It's a well documented fact that the most obvious/ridiculous scams work the best, because they help select the most gullible potential victims. https://www.microsoft.com/en-us/research/publication/why-do-nigerian-scammers-say-they-are-from-nigeria/ https://www.microsoft.com/en-us/research/publication/why-do-...
- n2d4 3y agoThis is only true for high throughput spam e-mails, such as those sent to literally every e-mail address in a large data breach. Corporate phishing attacks are much, much more advanced.
- comicjk 3y agoThat analysis is from the perspective of the scammer. The scammer has limited time to write to each victim once the responses come back from the initial mass-email, so the scammer is better off if only the most gullible people reply. From the perspective of the person being attacked, the counterintuitive result based on selection bias goes away, and a more convincing scheme is more of a risk to you personally. (The assumption that scammers have limited time to write to each victim may itself become less true because of LLMs.)
- izacus 3y agoThat doesn't mean those scams are actually commonly successful.
- nebulous1 3y agoI agree, but actually it's just a really bad example that takes the reader to the wrong place because it has the participants acting so irrationally. The underlying issue is still there, they've just distracted from it by putting this in and having the reader go "hang on a second". They should have used a situation that was more believable, but also concentrated more on requests where the target likely wouldn't even seek confirmation.
- salesynerd 3y agoOne scenario where this night not be far-fetched is when such mails are sent to the accounts payable department of large companies. The people are not going to call a line manager everytime a payment request comes through email, especially if the dollar amount is small and didn't require pre-approval. I remember even Google had fallen prey to such a scam where they were paying somebody even though no work was done. Admittedly, that case involved fictitious invoices. However, the principle remains the same.
- sonicanatidae 3y agoThis attack works like normal Sales calls. Hit enough of them and you'll find someone that's new, or in a rush, or distracted or ancient or challenged or a Republican idiot, or, or. That's why it's still in use today. It works, but takes a lot of "cold calling" via phishing to find targets.
- michaelmrose 3y agoA more trivial gambit is logging into an attacker controlled site leaking credentials or installing malware. Also office drones are probable targets. They won't want to waste important peoples time asking for confirmation.
- willd13 3y agoStill pretty cool trick though
- mikeiz404 3y agoI agree the example they give seems a bit unlikely especially since the subject line is not changing (though admittedly I do not have experience in this area). However something a little more subtle such as swapping out a routing number from a legitimate to an illegitimate one could be done and that seems harder to catch especially if the person who forwarded it to you is supposed to verify it first.
- maaaaattttt 3y agoI see that some of the email clients mentioned wrap the mail’s content in extra HTML tags and modify the CSS and classes names. I’m wondering why email clients don’t use sandboxed iframes to render HTML email? Do they still present security risks?
- red_trumpet 3y agoThe extra HTML does not happen from the client reading the forwarded email, but when forwarding. That is expected, because the forwarding party might want to add more text to the email.
- echoangle 3y agoAt least the person forwarding the mail could check the preview and see that the text changed.
- Savageman 3y agoIn the past I had issues using iframes. Not for rendering or security issue (those work great in my memory). But if your email has a link to your website, and your sandbox iframe disallow Javascript, then this "security context" is carried over to the page that was opened from clicking the link inside the iframe, and you website cannot use JS. [edit] The solution was "allow-popups-to-escape-sandbox", so I see no reason it would not work.
- echoangle 3y agoWouldn’t this be fixable by not allowing Stylesheets but only inline style attributes on the tags? To improve usability, email clients could include an automatic step where all Stylesheets are “compiled” to inline styles. The only thing this would break would be advanced CSS selectors (hover etc.) but I’m not sure they would be needed.
- chromanoid 3y agoI agree. Just baking all classes into inline styles before even presenting the mail should fix this. It makes sense to do this anyway. Pseudo classes and media queries wouldn't work, but those would pose a security risk anyway and are not supported by major mail clients (see https://www.caniemail.com/features/css-at-media/ https://www.caniemail.com/features/css-at-media/)
- ketch 3y agoThis would also break the current approach for responsive emails. Usually the default/desktop styles are already compiled and inlined, then a style tag with media query selectors is used in the `head` to improve readability for mobile devices.
- yosefk 3y agoThe horror! Is there a real need here though as opposed to just something people do, and where does such CSS come from in the case of emails? You could be "responsive" by not doing certain things instead of actively doing something and for email content it feels fitting.
- quesera 3y agoThis is really clever! Premise: CSS in HTML email allows some text to be visible only after the message is forwarded. This is a huge threat to the trustworthiness of verified email! Examples given in Thunderbird, Outlook, Gmail. Excellent work. I read all mail in mutt, so this is officially "someone else's problem". ... Consequently, I'll complain about something else: > This issue was reported to Mozilla on 05.03.2024. The planned release date and a draft of the following section were communicated to Mozilla on 20.03.2024. I agree that little-endian dates make more sense than US-style middle-endian dates. But I will assert that any technologist who does not use ISO 8601 date formatting (2024-03-05, with or without hyphens), is doing it wrong. :)
- shrimp_emoji 3y agoNot only that, but any person using middle-endian date format is doing it wrong. It's the least rational way to write something! Little-endian at least has the virtue of just being backwards relative to how you write every other number, but middle-endian is just bonkers. (So of course it's the way Americans do it.)
- _blk 3y agoI thought so too for most of my life but living in the states has changed my perspective since the practice is coherent with spoken language. Now I mostly write out the month to make it clear. Let me just appeal to all Americans to use slashes as separators and not dots. Side note: Military format 12MAR24 seems both concise and unbiguous but most people understandably find that unusual (just like ISO dates)
- afavour 3y agoThe real risk to your organisation is that the developer you assign to generate HTML emails will go mad, lock themselves in the server room and destroy all the hardware while screaming “why is Outlook rendering DIFFERENT” (Seriously though, this is a fascinating exploit)
- lobsterthief 3y agoThis is why I decided years ago to just pay an HTML email coding service for anything email-related. There’s a lot of bespoke knowledge required for coding HTML templates that pass litmus tests and I never want to go there again.
- ognarb 3y agoI long argued that we should use markdown (without the inline HTML) or a similar simple text markup instead of HTML for rich text in emails. This would makes it easy for emails clients to decide about either showing the text as rich text or just plain text, while supporting most of the formatting that a normal user might need: bold, italic, quotes, inline images, code blocks, headers, ... Sure it wouldn't be good for marketing emails with the super advanced HTML but I don't think anyone should care about this use-case.
- PaulDavisThe1st 3y agoGiven that the Lynx browser (HTML in a text terminal) continues to function reasonably well, why is there any need for a different markup language?
- layer8 3y agoIt helps for keeping the feature set limited. With HTML, the incentive to use a full-blown implementation is just too strong, and the risk of inconsistent implementations and deliberate or accidental extensions too high.
- lobsterthief 3y agoYou could also in theory just restrict which HTML elements can be used. You’d need to do that anyway for MD, especially since MD can contain HTML itself. I’m a huge fan of MD either way ;) I’ve built entire large sites where raw content is stored in MD (along with a MD WYSIWYG) and then the MD is converted to HTML. I’ve found it’s easier and more reliable to parse MD vs HTML, unless of course you’re using a block editor or something more structured.
- layer8 3y ago> You could also in theory just restrict which HTML elements can be used. That’s not enough, because you also have to restrict what attributes they may carry (inline styles, event handlers), the type of meta tags and image formats, and so on. But in any case, such a restricted subset was what I was already presuming in my comment.
- velcrovan 3y ago"Why emails are a risk to your organization" there fixed it for you
- wongarsu 3y agoAt that point it's just "why communication with the outside is a risk to your organization". This article presents an attack vector unique to HTML emails, but most attacks over email can be easily adapted to work over WhatsApp, Slack, Jira, Zoom, or whatever else people use to communicate with the outside world.
- deleted 3y ago[deleted]
- deleted 3y ago[deleted]
- RedShift1 3y agoWhere does the term "kobold letters" come from?
- JLCarveth 3y agoFrom the article "I’ll refer to these elements as kobold letters, after the elusive sprites of mythology."
- mschuster91 3y ago> To prevent the CSS of emails to affect the style of the webmailer, Outlook modifies the email by prefixing all ids and classes with x_ and adjust the CSS accordingly. Wait what, OWA loads emails directly into the same DOM tree as the rest of the app instead of an iFrame?
- kevingadd 3y agoSo does gmail.
- jgrahamc 3y agoSee also: The Spammers' Compendium: https://www.virusbulletin.com/resources/spammerscompendium/ https://www.virusbulletin.com/resources/spammerscompendium/
- nickburns 3y agoIf we style the kobold letter as an overlay, we can not only affect the forwarded email, but also (for example) replace any comments your manager might have had on the original mail, opening up even more opportunities for phishing. clever doesn't even begin to adequately describe. tangentially and anecdotally, it's only occurred to me fairly recently, like within the past year or so, to configure all my mail clients, including both desktop and mobile Outlook (and OWA), to not 'automatically download new messages'. this really needs be the default setting.
- remram 3y agoWhy?
- nickburns 3y agoso as not to automatically download any HTML content i don't want to download since those calls are trackable. my guess is you're confused and you think i mean i've disabled mailbox sync or something...? obviously not. i don't know, man, questionable downvote first/clarify second. but you're welcome for the gratuitous privacy tip.
- remram 3y agoWhat a load of ramble and bile for a simple question.
- nickburns 3y agoWhat a load of ramble and bile for a simple question at least part of my guess was correct i see. you strike as the type to ask lots of 'simple' questions. 'bile', lol. what a flowery and poetic insult. thanks.
- deleted 3y ago[deleted]
- sylware 3y agoDon't let me start on phishing SMS texts... still around and strong. My phone will fireup a non-big-tech noscript/basic (x)html browser if I mistakenly click on an URL in it AND my phone does not run android (or an other linux based phone OS) nor iOS.
- cozzyd 3y agoSome possible mitigations from the top of my head (maybe ineffective): - warn prominently on hidden elements - randomize the number of enclosing div, on both incoming and outgoing - compute what the forwarded message would look like on forwarding, ask for confirmation if differs significantly. Or do the opposite (probably more effective since doesn't require other clients to help)
- SoftTalker 3y agoClever trick. It reinforces the position I've held since the 1990s. Emails should be text. HTML is for web pages.
- tombert 3y agoI've been using exclusively plain-text email for a long time, and it's not even for security; I want to be able to respect people's font choice. When you send HTML emails, the font is chosen by the sender, which normally is fine, but some people prefer to use dyslexic-friendly fonts (e.g. OpenDyslexic or Comic Sans) to read their email, and I don't want my message to be artificially more difficult to read. Since most emails really don't need elaborate formatting, I'm not 100% sure why this isn't the default.
- eviks 3y agoWhat prevents the client app from overriding this font option? Plain text disrespects readability aspect since you lose the most basic highlighting like bold/italics
- tombert 3y agoI don’t think anything “stops” you from overriding the font, outside of potentially breaking formatting. It just doesn’t appear to be directly enabled on most clients; it seems like most clients will default to the font the email uses for HTML.
- radarsat1 3y agoThe other day I was discussing the design for an "update" email that our designer was putting together and showing me the size of this stupid graphical header he put at the top and I was showing him how with that you can't even see the text of the title of the email without scrolling down, and then he forwards some other version to me for more feedback and suddenly started getting all disturbed and upset because something looked different to him.. like the fonts were a bit smaller.. and then he said, oh no, when you forward it, it transforms it to the desktop version, instead of the mobile version! And I'm sitting there in disbelief, just staring at him, like,... this is EMAIL we're talking about, what do you mean "desktop" version and "mobile" version? How is that even a thing? What do you mean it "transforms" it? It's literally just copying it! The fact that it "breaks" when you do that is evidence of how stupid this is. My god man, why is CSS in my email at all? The fact that we haven't adopted something much simpler to just be able to express italics or whatever, like markdown, is just bonkers to me. It just shows how little anyone cares about actually improving the situation. And all just to cater to the bizarre corporate need to put logos and banners everything. HTML email is just ridiculous.
- JacobThreeThree 3y agoResponsive email frameworks are a thing, like MJML.
- jcranmer 3y ago> The fact that we haven't adopted something much simpler just to be able to express italics or whatever, like markdown, is just bonkers to me. Sounds like you want text/enriched [1], which was published in (checks notes) 1996 and has read support in likely every email client ever. [1] https://www.rfc-editor.org/rfc/rfc1896.txt https://www.rfc-editor.org/rfc/rfc1896.txt
- radarsat1 3y agoSure, and how many people use it? Available != adopted.
- shortformblog 3y agoA classic cut off the limb to fix the cut solution. The problem is bad standardization for email that has allowed hacks like this to rule the day. HTML in general is susceptible to these very concerns. Plenty of emails exist that use HTML without incident. This reads as one user’s frustration with something in the wild that is dressed as a security issue.
- hannob 3y agoWhen efail came out, I wrote a blogpost about the security risks of HTML mail. It is really amazing how problematic all of this is, despite its widespread use. The HTML mail spec is really old, and contains almost no security considerations. HTML in emails can only be a subset of HTML to be secure. But nobody has ever defined what exactly that subset is, so everyone does whatever they think. And unsurprisingly, this leads to an endless stream of security flaws. See: https://blog.hboeck.de/archives/894-Efail-HTML-Mails-have-no-Security-Concept-and-are-to-blame.html https://blog.hboeck.de/archives/894-Efail-HTML-Mails-have-no...
- tonymet 3y agothis highlights a broader issue of irreproducible content. Another good example are group chats where some recipients see messages inconsistently or in a different order than others. It can happen due to inconsistent delivery, inconsistent ACLs, or other reasons. How can people agree on things when they are not looking at the same thing? And people assume that everyone sees what they see by default. Can a board make a decision when not everyone has the same presentation of facts? Remember when you judged someone for asking a stupid question when the answer was just posted a moment ago? How do you know they even received it?
- ledgerdev 3y agoBetween these sorts of email tricks and ability to easily voice clone using ai, it would seem that invoicing systems should put some sort of 2 factor approval/confirmation into the workflow for payouts.
- deleted 3y ago[deleted]
- rglover 3y agoHTML in email shouldn't be as big of a nightmare as it is. It really comes down to rendering engines. If all email clients just checked for text vs HTML and when HTML switched the rendering engine to Webkit, this problem could be solved overnight. There's zero reason why you can't render an email the same way you can as a regular page (minus JavaScript). Out of curiosity, is anybody working on this? It seems like a standard could be produced w/ relative ease to make it easier on vendors. Imagine somebody has at least proposed the idea before...
- upofadown 3y ago>...it may even be cryptographically signed ... In general, anything you are going to sign has to be in a simple enough format to make it so that the sender and the receiver(s) can actually determine what is signed. HTML should automatically be considered unsigned. It simply is not suitable for the purpose.