3

Email providers like Gmail,yahoo,hotmail do not load images in the email directly. These services require you to allow the images to be laoded. Why do they do this? Is it to prevent XSS/CSRF?

2
  • It has nothing to do with xss, but it is to prevent get based csrf. sri's answer is good.
    – rook
    Aug 31, 2010 at 15:37
  • Nowadays Gmail fetches all referenced images as soon as the original mail hits the Gmail servers. This prevents spammers from getting info about if the mail is read by somebody and still allows Gmail to show the images immediately a message is displayed. (Of course, this requires that spammers understand this, too, or Gmail would get even more spam.) Jan 6, 2018 at 16:50

3 Answers 3

5

Two reasons - Privacy and CSRF.

Privacy

It allows the sender to figure out whether I have opened the email or not, without my knowledge. Spammers can figure out whether their "marketing" campaigns have had any impact or not.

CSRF

For CSRF to work, the victim has to click a link or visit the attackers page. If email clients were to display images automatically, just opening an email would be sufficient to launch a CSRF attack.

For example, lets assume paypal had a csrf vulnerability. Also assume that the user was logged on to paypal. Now, an attacker sends the user an email with <img src="http://paypal.com/transferfunds?fromAccount=victim&toAccount=attacker"/>. As soon as the user opens the email, funds would get transferred.

2

Because this allows the (potentially hostile sender's) server to know the email was received.

2
  • i don't see any harm in this? any vulnerabilities in this?
    – RJ.
    Aug 31, 2010 at 9:40
  • Define 'harm'. For example, it would let a spammer know which addresses are active and which are not, to spam more efficiently. It would let them profile you according to "which emails you are likely to open", etc. Aug 31, 2010 at 10:34
0

A lot of spam mails use images to identify valid mail addresses, by embedding malicious images in content. For example:

<img src="http://example.com/[email protected]" />

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.