General Security & ANU Hacking

[emoore]

Originally Posted by TenFour

I don't believe showing attachments executes the program. For example, if a PDF is attached all I can see is its title. In Outlook you can Preview the file, but you have to select an option and click on it to do it. I have to double click to actually open it. You can set many email clients to not automatically download images, and then you won't see those unless you select to.

There is a big difference between displaying attachments inline (which displays it as part of the message body, if possible) and listing attachments (which just lists the filename and possibly the file size of each attachment, after the body of the message). None of this has anything to do with remote images or previewing.

In Thunderbird you use "view -> display attachments inline" to indicate you prefer to display attachments inline (when possible to do so). Its a sticky setting, you don't need to select it for each message. Its risky because you don't get to decide if the attachment is safe before its opened.

Outlook appears to have multiple "preview" options. One is to preview an attachment (what I think you were talking about), another uses view -> message preview (where you have to configure it for 1-3 lines) and they also talk about previewing a entire message by reading it in the reading pane.

https://support.office.com/en-us/art...B-9F9B8C6D53F0

[TenFour]

So, previewing attachments inline by default with some email clients is potentially dangerous. Not sure if that is what caused the original hack described in this thread, but useful to know. Maybe I am wrong, but my understanding of Gmail previews is that you are looking at an image of the attachment and no code or scripts can be run.