Apple Mail and its security.

Apple’s Mail client, aptly named Mail, is pushing closer towards more HTML email content in every major release of OS X. HTML email is a bit of a cinch, as a lot of people use cleartext clients (I set my Gmail to it) but most importantly, it’s a security issue. This wouldn’t be the Cocoia blog if we investigated what risks could go with Apple Mail’s HTML email facility.

First of all, a bit of background; Safari, Apple’s browser, uses the Webkit rendering engine. Webkit’s seen it’s share of exploits, as a any HTML rendering facility has. Apple Mail has an implementation of Webkit to render it’s HTML content. This is nicely illustrated when you go to a page in Safari. From there, you can easily make the page into an email (something I did for my mass-mailing of beta invites in HTML format).

So, what could ever go wrong? First and foremost, a major issue that isn’t yet solved in any email client: Spam.

Any spam email you read and embeds images or other web-based content with an external link, can be used to track your IP address and to see if you read your email. We all already know the links on the bottom of spam that ‘allows you to no longer recieve emails from this address’. It’s a great way to determine if someone reads the spam. The same goes for HTML email. For this reason, Gmail doesn’t load images automatically. EDIT; Mark Rowe (from the Webkit team) has commented that Mail doesn’t do this as well. Kudo’s, although I have found that all users around me have the setting in the ‘Viewing’ preferences, ‘Display images’, enabled.

XSS in Javascript can do some nasty stuff. I am a fanatic reader of the great ha.ckers security blog, and it often has great in-depth articles about the latest disclosed problems with Cross-Site-Scripting. Although there is very little on the blog about Webkit, some XSS is actually cross-platform. XSS could be brought to you with HTML or embedded content like images and Javascript. EDIT; Mark pointed out that Javascript doesn’t work in content. Avenues for HTML attacks aren’t transparent to me, and I hope Mark can give me more insight on this.

Quicktime exploits are common. Webkit is integrated with Quicktime, allowing for inline rendering of video’s and audio files. Quicktime is really a piece of software that gets patched with every minor update of OS X. Over this attack vector, one could easily try a mass-attack. Remember that the email address itself doesn’t even need to be valid; only the attached content that you will be executing. EDIT; (Mark pointed out that Quicktime doesn’t work embedded, but it does in attachments.)

Only these three major issues listed, it already shows the risks you are taking by using HTML email on your Mac, or any other OS. With Windows, it’s, of course, a lot more risky, but I really don’t deal with Windows. I suggest anyone to closely scrutinize his own needs to see if you really, really need HTML email, and if you do, only open HTML email from a trusted and verified source.