Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Roundcube Webmail: SVG feImage bypasses image blocking to track email opens

nullcathedral.com

Post reply on HN
Print view View original

51–60 of 81 posts

Re: Roundcube Webmail: SVG feImage bypasses image blocking to track email opens

#51

Post by teekert »

mzi wrote: post #12
smelendez wrote: post #4

I often think the best way to defeat email open tracking would be for a mainstream email client to prefetch every image when a non-spam email is received and cache it for 72 hours or so. Every email gets flagged as “opened,” so the flag is meaningless, and recipients can see the images without triggering a tracker.

I worked for a short time for an American company. They had periodic phishing test from Mitnick. The links in those emails was not to be clicked as it would trigger a mandatory training. The emails also had a header saying they were a phishing test, so I deleted all those emails in a filter. The company also ran a mail filter called Baracuda or something similar that followed links in emails to see if they were malic…

Hmm, mixed feelings.

Sure you are being clever, but (and I don't know the state of art science wrt effectivity of these fake phishing emails), you are defying a measure that was taken by management to try to make the company safer. Sure it may feel, and even be, a waste of time. But you are also putting yourself above the rules in a way. Your assumption is that these programs will actually NOT make the company safer, with 100% certainty. Because even of it makes the company 1% safer, it is management's responsibility to go ahead with these measures or not.

I don't know what to think of how you acted, as much as I hate most mandatory course, at least some if my knowledge comes from them. Obviously the company pays you normally while you take the course. And somewhere I feel that "work is work".

Of course, in this case, you have shown the system to be erroneous, while showing yourself to feel superior. Difficult... As manager I'd like you to seek a conversation with me.

Edit: Of course, you are 100% free to leave this company, are you 100% free to cheat on cyber security measures? I don't think I agree with you there.

As said, mixed feelings.

Re: Roundcube Webmail: SVG feImage bypasses image blocking to track email opens

#52

Post by RobotToaster »

kijin wrote: post #31
smelendez wrote: post #4

I often think the best way to defeat email open tracking would be for a mainstream email client to prefetch every image when a non-spam email is received and cache it for 72 hours or so. Every email gets flagged as “opened,” so the flag is meaningless, and recipients can see the images without triggering a tracker.

That's not enough. As the article explains, SVGs can reference external resources. So you also need to prefetch those external resources, recursively, if you want to be thorough.

To add to this, those external resources aren't limited to images, they can be basically anything, foreignObject allows video.

I'm also wondering if you could (ab)use SMIL mouse events to bypass this approach.

Re: Roundcube Webmail: SVG feImage bypasses image blocking to track email opens

#53

Post by jonathanlydall »

jojomodding wrote: post #50
jonathanlydall wrote: post #5

Slightly related, but fraudsters love using .svg attachments, typically the mails purport to be for an invoice which you need to log into your Microsoft account to be able to “securely” view. I’m not sure if Exchange Online doesn’t scan them or something, but I landed up making a rule which blocks all emails with either .svg or .htm(l) attachments and to notify me when blocked. Happens a couple of times per month for…

I know someone who embeds an SVG of his signature in their emails. Looks pretty cool, renders inline, and it's sad that the state of things means they'll probably have to remove it because it triggers spam filters.

I don't block embedded SVGs, just ones included as attachments, so I don't think it would affect your friend's use case.

Re: Roundcube Webmail: SVG feImage bypasses image blocking to track email opens

#55

Post by lyu07282 »

teekert wrote: post #51
mzi wrote: post #12

Earlier quoted context omitted.

I worked for a short time for an American company. They had periodic phishing test from Mitnick. The links in those emails was not to be clicked as it would trigger a mandatory training. The emails also had a header saying they were a phishing test, so I deleted all those emails in a filter. The company also ran a mail filter called Baracuda or something similar that followed links in emails to see if they were malic…

Hmm, mixed feelings. Sure you are being clever, but (and I don't know the state of art science wrt effectivity of these fake phishing emails), you are defying a measure that was taken by management to try to make the company safer. Sure it may feel, and even be, a waste of time. But you are also putting yourself above the rules in a way. Your assumption is that these programs will actually NOT make the company safer,…

This could go straight on r/LinkedInLunatics, the PMC is insane

Re: Roundcube Webmail: SVG feImage bypasses image blocking to track email opens

#56

Post by Ndymium »

geocar wrote: post #44
TazeTSchnitzel wrote: post #40

Earlier quoted context omitted.

Why on earth does the HTML sanitiser allow blacklisting?! That can't ever be safe to use, the set of HTML elements can always change.

I mean, at least they eventually came to their senses, but it does not inspire confidence! https://developer.chrome.com/blog/sanitizer-api-deprecation/

That's the old sanitizer API. That was already removed and what you linked earlier is the new sanitizer API.

Re: Roundcube Webmail: SVG feImage bypasses image blocking to track email opens

#57

Post by Ndymium »

TazeTSchnitzel wrote: post #40
geocar wrote: post #39

Earlier quoted context omitted.

I think the problem is what is an image? I made an attempt to enumerate them[1], and whilst I catch this issue with feImage over a decade ago by simply observing that xlink:href attributes can appear anywhere, Roundcube also misses srcset="" and probably other ways, so if the server "prefetched every image" it knew about using the Roundcube algorithm the one in srcset would still act as a beacon. I feel like the bigg…

Why on earth does the HTML sanitiser allow blacklisting?! That can't ever be safe to use, the set of HTML elements can always change.

Note that the API is split into XSS-safe and XSS-unsafe calls. The XSS-safe calls [0] have this noted for each of them (emphasis mine):

> Then drop any elements and attributes that are not allowed by the sanitizer configuration, and any that are considered XSS-unsafe (even if allowed by the configuration)

The XSS-unsafe functions are all named "unsafe". Although considering web programmers, maybe they should have been named "UnsafeDoNotUseOrYouWillBeFired".

[0] https://developer.mozilla.org/en-US/docs/Web/API/HTML_Saniti...

Re: Roundcube Webmail: SVG feImage bypasses image blocking to track email opens

#58

Post by direwolf20 »

hedora wrote: post #35
londons_explore wrote: post #27

Earlier quoted context omitted.

Gmails prefetch is terrible for privacy because it honors http cache headers, which means tracking companies simply use a "no-cache, must-revalidate" header to defeat it.

That sounds like a feature, not a bug, given where Google’s revenue comes from.

Google's revenue comes from Google's ads, not other people's ads, and they already know when you open your emails. They should block remote loading, to ensure their ad platform works better than other people's.

Re: Roundcube Webmail: SVG feImage bypasses image blocking to track email opens

#59

Post by teekert »

lyu07282 wrote: post #55
teekert wrote: post #51

Earlier quoted context omitted.

Hmm, mixed feelings. Sure you are being clever, but (and I don't know the state of art science wrt effectivity of these fake phishing emails), you are defying a measure that was taken by management to try to make the company safer. Sure it may feel, and even be, a waste of time. But you are also putting yourself above the rules in a way. Your assumption is that these programs will actually NOT make the company safer,…

This could go straight on r/LinkedInLunatics, the PMC is insane

Hmm, never been there, but it never feels good to be lumped in with some group (especially when they have lunatics in the name) instead of receiving feedback that may point at errors in judgement.

I'm generally considered knowledgeable and I'm just thinking from the perspective of owning a company and employees taking these actions instead of coming to talk to me, showing evidence of my poor management decisions.

This whole text reeks of a employee vs employer situation, which is never good (you're in it together), so probably it is good that the person left the company, for both parties.

Perhaps I'm naive, or not American enough, US work culture seems harsh to me sometimes, especially wrt work ethic and hierarchy.

I'm off now to find what PMC is, thank you.

Edit: Looked around for sometime, no idea still what PMC is.

Re: Roundcube Webmail: SVG feImage bypasses image blocking to track email opens

#60

Post by fx1994 »

smelendez wrote: post #26
mzi wrote: post #12

Earlier quoted context omitted.

I worked for a short time for an American company. They had periodic phishing test from Mitnick. The links in those emails was not to be clicked as it would trigger a mandatory training. The emails also had a header saying they were a phishing test, so I deleted all those emails in a filter. The company also ran a mail filter called Baracuda or something similar that followed links in emails to see if they were malic…

Did everyone get flagged then thanks to Barracuda? You’d think they’d realize there’s a problem if there’s a 100% fail rate. Edit: also, to be fair, you basically told them you had opted out of the test, so it’s not completely ridiculous for them to ask you to do the training instead.

to be fair someone started using computers and has x worthelss security certificates but yes he will teach me how to use computer/Internet...okidoki... I just move to trash all their tests as it's just spam.
Post reply on HN