Leebra security
login register

Security Vulnerability of HTML Emails - Schneier on Security

3 years ago by 0x0 to c/security

save

share

report

This is a newly discovered email vulnerability: The email your manager received and forwarded to you was something completely innocent, such as a potential customer asking a few questions. All that email was supposed to achieve was being forwarded to you. However, the moment the email appeared in your inbox, it changed. The innocent pretext disappeared and the real phishing email became visible. A phishing email you had to trust because you knew the sender and they even confirmed that they had forwarded it to you. This attack is possible because most email clients allow CSS to be used to style HTML emails. When an email is forwarded, the position of the original email in the DOM usually changes, allowing for CSS rules to be selectively applied only when an email has been forwarded...

When an email is forwarded, the position of the original email in the DOM usually changes, allowing for CSS rules to be selectively applied only when an email has been forwarded.

CaptObvious 1 point 3 years ago

Wonder if the same technique could be used to poison class essay prompts?

save

path: 0 9203753, hotness: undefined, score: 1, children: 0
0x0 0 points 3 years ago

Who would've thought...

/s

save

path: 0 9203263, hotness: undefined, score: 0, children: 0
security
security

@programming.dev

login for more options
2202
173
93

A community for discussion about cybersecurity, hacking, cybersecurity news, exploits, bounties etc.

Rules :

  1. All instance-wide rules apply.
  2. Keep it totally legal.
  3. Remember the human, be civil.
  4. Be helpful, don't be rude.

Icon base by Delapouite under CC BY 3.0 with modifications to add a gradient

go to feed...