Great research, though it seems like a very small set of email clients could be affected (and rare to have vulnerable configuration settings). I'm more interested in other use cases for that unclosed image tag in Apple Mail, iOS Mail and Mozilla Thunderbird.https://twitter.com/seecurity/status/995964977461776385 …
Do any email clients load remote images without user interaction by default?
-
-
I *believe* several mobile clients do, as some recent investigations used sales/analytics tracking links embedded in emails and we were concerned about victims' home egress IPs, among other target profiling data. TBH, I don't empirically know the answer but would love more info!
-
I think it’s on by default, iOS. first thing I disablepic.twitter.com/AaU0CuI13A
- 3 more replies
New conversation -
Loading seems to be taking a while.
Twitter may be over capacity or experiencing a momentary hiccup. Try again or visit Twitter Status for more information.