7 ms·
Roundcube Webmail: SVG feImage bypasses image blocking to track email opens
- Galanwe 7mo agoNice catch! I am trying to read as less _online_ as possible nowadays. I essentially have dovecot in my crontab, and read it off roundcube. It's been working great, RoundCube is dead simple to setup and use, the UI and search are very fast.
- stragies 7mo agoHmm, I wonder, if roundcube was the exception (w.r.t feImage), or if soon other webmail clients will need to be patched
- nullcathedral 7mo agoAuthor here! I have looked at Thunderbird. I'll go and look at some others as well, should have probably done that earlier.
- zimpenfish 7mo agoI wouldn't vouch 100% for my PHP understanding but it looks like SnappyMail removes `<svg>` elements entirely (`BuildHtml` in `snappymail/v/2.38.2/app/libraries/MailSo/Base/HtmlUtils.php`)
- smelendez 7mo agoI often think the best way to defeat email open tracking would be for a mainstream email client to prefetch every image when a non-spam email is received and cache it for 72 hours or so. Every email gets flagged as “opened,” so the flag is meaningless, and recipients can see the images without triggering a tracker.
- mmh0000 7mo agoSome of the big providers already do this, notably Apple and Gmail: https://www.litmus.com/blog/gmail-prefetching-images https://www.litmus.com/blog/gmail-prefetching-images
- deleted 7mo ago[deleted]
- londons_explore 7mo agoGmails prefetch is terrible for privacy because it honors http cache headers, which means tracking companies simply use a "no-cache, must-revalidate" header to defeat it.
- hedora 7mo agoThat sounds like a feature, not a bug, given where Google’s revenue comes from.
- direwolf20 7mo agoGoogle's revenue comes from Google's ads, not other people's ads, and they already know when you open your emails. They should block remote loading, to ensure their ad platform works better than other people's.
- RobotToaster 7mo agoWhich is completely stupid since images in an email should never change.
- iamacyborg 7mo agoWhy shouldn't they? There's plenty of scenarios where you might want to swap images after a period of time has elapsed, or to fix a mistake.
- londons_explore 7mo agoThe ability to swap images but not text seems arbitrary. You could imagine a system more like the notification tray on iOS/Android where at any time a notification can appear, be edited, timeout, or be deleted. Your email inbox could be like that. The email saying "Your parcel has been dispatched" could be edited to say "Your parcel has been delivered". When you refund something you've bought, the original purchase receipt could be crossed out or hidden. When you get invited to a wedding but then the wedding is cancelled, the original invite could be deleted, etc.
- Saris 7mo agoI think this is what icloud does. Seems like an easy way to make tracking useless if every client did it.
- mzi 7mo agoI worked for a short time for an American company. They had periodic phishing test from Mitnick. The links in those emails was not to be clicked as it would trigger a mandatory training. The emails also had a header saying they were a phishing test, so I deleted all those emails in a filter. The company also ran a mail filter called Baracuda or something similar that followed links in emails to see if they were malicious. I was quite annoyed when I was called to do the mandatory training as "I" had clicked a link (on an email I hadn't seen) and more so when told I had no other recourse than to sit through it. I resigned shortly afterwards.
- smelendez 7mo agoDid everyone get flagged then thanks to Barracuda? You’d think they’d realize there’s a problem if there’s a 100% fail rate. Edit: also, to be fair, you basically told them you had opted out of the test, so it’s not completely ridiculous for them to ask you to do the training instead.
- hedora 7mo agoThere’d be a bigger problem for the security training folks if there was a 100% pass rate.
- fx1994 7mo agoto be fair someone started using computers and has x worthelss security certificates but yes he will teach me how to use computer/Internet...okidoki... I just move to trash all their tests as it's just spam.
- kbenson 7mo agoThe test is whether you can successfully identify phishing attempts bu approximating what they look like in the wild. Bypassing the test entirely means there's no data on whether you're susceptible to this, and just because someone knows there's a header and how to bypass something doesn't mean they aren't also the kind of person to be distracted and click on stuff they shouldn't. This method of test passing wasn't okay when Volkswagen did it, and it's not appropriate for employees at a company that asks them to take the test, for the exact same reason.
- BobbyTables2 7mo agoThat still provides “human” vs “bot” feedback to the sender. An automated system processing emails isn’t going to be fetching images or rendering attached SVGs.
- gigel82 7mo agoThat is still signal that the email address is valid. I'd prefer something like the server immediately sending a SMTP 550 5.1.1 (unknown recipient error), for anything that's immediately recognized as spam (or marked as spam in the past by the user). That gives no signal at all and might even persuade some scammers to remove your email address from their list.
- hedora 7mo agoIf you don’t follow spam links, then it lets the spammer probe your spam filter, and try stuff until you follow links. A better approach is to follow all links always (even to non-existent recipients) if you must play this game. That reminds me: I should make sure all my mail clients are still set to plain text rendering.
- dmitrygr 7mo agoI hereby remind you of a bet you lost: https://news.ycombinator.com/item?id=39186555 https://news.ycombinator.com/item?id=39186555 :) my contact info is in my profile to arrange settlement
- deleted 7mo ago[deleted]
- kijin 7mo agoThat's not enough. As the article explains, SVGs can reference external resources. So you also need to prefetch those external resources, recursively, if you want to be thorough.
- RobotToaster 7mo agoTo add to this, those external resources aren't limited to images, they can be basically anything, foreignObject allows video. I'm also wondering if you could (ab)use SMIL mouse events to bypass this approach.
- easygenes 7mo agoI knew the people who were setting this up for Yahoo like 10 years ago. Lots of major providers do it now.
- geocar 7mo agoI think the problem is what is an image? I made an attempt to enumerate them[1], and whilst I catch this issue with feImage over a decade ago by simply observing that xlink:href attributes can appear anywhere, Roundcube also misses srcset="" and probably other ways, so if the server "prefetched every image" it knew about using the Roundcube algorithm the one in srcset would still act as a beacon. I feel like the bigger issue is the W3 (nee Google). The new HTML Sanitizer[2] interface does nothing, but some VP is somewhere patting themselves on the back for this. We don't need an object-oriented way to edit HTML, we need the database of changes we want to make. What I would like to see is the ability to put a <pre-cache href="url"><![CDATA[...]]></pre-cache> that would allow the document to replace requests for url with the embedded data, support what we can, then just turn off networking for things we can't. If networking is enabled, just ignore the pre-cache tags. No mixing means no XSS. Networking disabled means "failures" in the sanitizer is that the page just doesn't "look" right, instead of a leak. Until then, the HTML4-era solution was a whitelist (instead of trying to blacklist/block things) is best. That's also easier in a lot of ways, but harder to maintain since gmail, outlook, etc are a moving target in _their_ whitelists... [1]: https://github.com/geocar/firewall.js https://github.com/geocar/firewall.js [2]: https://developer.mozilla.org/en-US/docs/Web/API/HTML_Sanitizer_API https://developer.mozilla.org/en-US/docs/Web/API/HTML_Saniti...
- TazeTSchnitzel 7mo agoWhy on earth does the HTML sanitiser allow blacklisting?! That can't ever be safe to use, the set of HTML elements can always change.
- geocar 7mo agoI mean, at least they eventually came to their senses, but it does not inspire confidence! https://developer.chrome.com/blog/sanitizer-api-deprecation/ https://developer.chrome.com/blog/sanitizer-api-deprecation/
- Ndymium 7mo agoThat's the old sanitizer API. That was already removed and what you linked earlier is the new sanitizer API.
- jonathanlydall 7mo agoSlightly related, but fraudsters love using .svg attachments, typically the mails purport to be for an invoice which you need to log into your Microsoft account to be able to “securely” view. I’m not sure if Exchange Online doesn’t scan them or something, but I landed up making a rule which blocks all emails with either .svg or .htm(l) attachments and to notify me when blocked. Happens a couple of times per month for the our small company, no false positives yet.
- deleted 7mo ago[deleted]
- jojomodding 7mo agoI know someone who embeds an SVG of his signature in their emails. Looks pretty cool, renders inline, and it's sad that the state of things means they'll probably have to remove it because it triggers spam filters.
- jonathanlydall 7mo agoI don't block embedded SVGs, just ones included as attachments, so I don't think it would affect your friend's use case.
- michaelteter 7mo agoNot disputing the article, nor insinuating that there's some ulterior motive, but it's curious that this blog has only one post; and the About page suggests a lengthier history (with references to what would have been previous posts).
- nullcathedral 7mo agoAuthor here! Are you referring to the "What’s inside this vendor’s VMware images?" on the about page? That is merely an illustration of what goes on inside my head. This is the first article on my blog.
- michaelteter 7mo agoYes, those were the suggestions which made me think there was a disparity between the About and the posts (or lack thereof). Best of luck to you on your blog. I would suggest you also add a "welcome to my blog" post where you give a little background about why you're writing the blog and what kinds of content readers can hope to see in the future. There's no denying that you have little content, so you might as well make it clear to readers _why_ that is. Plus, it sets them up to be interested to see what's coming next.
- nullcathedral 7mo agoGood suggestion! Thanks. I'll go write up a welcome post soon :)
- Avamander 7mo agoSVGs are just the tip of the iceberg of how hard it is to sanitize email content. There aren't any purpose-built good libraries for email sanitization either. Something that would handle SVG, CSS, HTML, everything.
- bawolff 7mo agoPut it in an iframe with a Content-Security-Policy header?
- Avamander 7mo agoSome providers do that. But you still have to dynamically allow or disallow external content such as images. It also makes any operations based on the content more convoluted. Like adding event invites to calendar and so on.
- deleted 7mo ago[deleted]
- jszymborski 7mo agoToo bad CORS doesn't fix this. It would be awesome to be able to sandbox a page completely.
- JimDabell 7mo agoYou can use CSP for this: Content-Security-Policy: img-src 'self';
- logicallee 7mo agowhatever happened to read receipts? I wouldn't mind allowing a sender who wants to know if I've opened their email, access to a read receipt about it.
- aspensmonster 7mo agoThey still exist. Surprisingly, most folks aren't interested in letting every newsletter and promotion know that they were seen. So a surveillance arms race ensues instead.
- 1over137 7mo agoYou disclosed this the day roundcube was patched. Isn’t it usual to give us time to deploy updates before disclosing details?!
- 8organicbits 7mo agoThe patch disclosed details pretty clearly already. https://github.com/roundcube/roundcubemail/commit/26d7677 https://github.com/roundcube/roundcubemail/commit/26d7677
- AnthonyMouse 7mo agoYou give the developer time to develop a patch. Once the patch is out, attackers can already deduce the vulnerability by looking at what changed and at that point you either want to immediately install the patch or you want to know what the vulnerability actually is so you can do something to mitigate it if there is some reason you can't immediately install the patch.
- kevincox 7mo agoFrom reading a little bit of the code it sounds like Roundcube's sanitizer is much closer to a blacklist than a whitelist. Any attempt to sanitize HTML with a blacklist is doomed to failure. Even if you read the current HTML spec (including referenced specs like SVG) and do a perfect job there are additions over time that you will be vulnerable to. Probably any unknown element attribute pair should be stripped by default. And that's still not considering different "namespaces" such as SVG and MathML that you need to be careful with.
- elric 7mo agoSVGs are such an amazing attack vector. Nearly every webapp I've seen that allows image or SVG uploads is vulnerable to XSS. If the Roundcube implementation allows for remote image fetching, it's probably worth checking it for XSS vulnerabilities. Also: what's the legal status of this kind of tracking? How does it jibe with the GDPR?
- RobotToaster 7mo agoI wondered what obscure part of the SVG spec included fel mages for a minute, damn sans serif.
- mike-cardwell 7mo agoI have added a test for this to https://www.emailprivacytester.com https://www.emailprivacytester.com
- iamacyborg 7mo agoThis is why SVG isn't supported well for email clients. https://www.caniemail.com/features/html-svg/ https://www.caniemail.com/features/html-svg/