Quote:

---

Dave_Howe said:
Re: "mime attachments are never invisible"
investigate the RFC for Mime Multipart/related - RFC 2387 - and you will find an interesting concept, of mime parts that are *hidden* from the viewer and can be referenced in the html of the mail as embedded objects such as a SWF.

---

The key phrase there is "invisible to the viewer". There's no way to conceal an attachment from the software parsing the mail. Whether and how your e-mail client displays attachments is up to its developer (and in some cases configurable by the user).

My point, though, is that the evidence is still contained in the original MIME-encoded e-mail sitting in the target's mailbox. The target's mail client will display the decoded contents, but most mail clients also offer an ability to view the "raw" (i.e. encoded) contents as well, and of course the mail file itself can be viewed with any text editor. Anyone bothering to do a little investigation would discover the "hidden" content, provided the receiver hasn't already deleted the mail. From the standpoint of someone sending a bit of tracer code, the risk of leaving this evidence behind on the target's computer is impractically large, particularly if the target works in a paranoid environment.

It's also worth noting that spam and mail-borne viruses have encouraged the development of software that closely inspects the raw and decoded contents of the e-mail you receive, and these filters look explicitly for embedded malware, web bugs, and suspicious MIME structures in the process. With more people using these kinds of tools to defend their mailboxes against spam and malware, it becomes much harder to "hide" such tracer code from the target--it gets flagged as suspicious automatically.

Post Extras:

Quote:

---

Lightstar said:
You don't know jack shit about computers. First off, you can hide an application in an e-mail and make it invisible. Second, you don't have to have the reciever activate the tracer, it activates upon opening of the e-mail. My dad worked for the NSA as a cryptographer. I would know.

---

If you want to argue on the basis of credentials, I write anti-spam and anti-virus software for a living, specifically mail server scanners (witness Maia Mailguard), and I lecture on related topics such as cryptovirology and malware. Your uncle Jack and I have known each other for more than 25 years

It is my business to understand e-mail-borne threats and how to neutralize them at the mail server, before they ever reach the recipient's mail client. When I speak of "visibility," I'm not talking necessarily about what the mail client exposes to the end-user, but rather what any raw mail processor (e.g. a mail filter or scanner) can see in the mail. There are certainly tricks to fool a mail client into not displaying an attachment to the end-user, but any application that offers a "raw" view of the mail will expose the malicious code for what it is, to humans and applications that know what to look for.

Web bugs are a perfect example of this sort of thing. They're HTML call-backs, essentially, and rely on modern e-mail clients to blindly try to load remote links (such as images) in HTML code. A mail filter can detect these trivially and neutralize such links before they are sent to the HTML processing engine--a feature that has been incorporated into many mail clients these days. I catch and neutralize several hundred of these attempts on a daily basis in my personal e-mail.

Now, if you want to talk about exploit-ware--malware written to exploit known vulnerabilities in specific mail clients--that's a similar matter. Once the exploits become known, new filter patterns are written to detect their characteristics in arriving e-mail. Only so-called "zero-day" exploits, which are as-yet unrecognized, will slip through to the recipient. With more and more ISPs and end-users running anti-virus and anti-spyware software on their machines, pre-processing their mail for them, the delivery of exploit-ware is unreliable.

More to the point, reliance on exploit-ware requires knowledge of the recipient's specific mail client--do you know she's using Microsoft Outlook? If she's using Mozilla Thunderbird, or Eudora, that exploit won't work. It even requires assumptions about the platform the recipient is using--an exploit that targets Thunderbird under Windows won't necessarily affect someone running Thunderbird under Linux, or on a Mac. It's far from reliable as a tool for targeting a specific recipient, unless you know these things ahead of time. Even then, the target recipient may read her mail from multiple platforms and with multiple clients--perhaps Outlook Express on a Windows box at home, Thunderbird on a Mac at work, and via Yahoo! web-mail when she's traveling.

My point (as I believe I've stressed several times by now) is that it would be drop-dead stupid for the NSA or any other organization to try to pull a stunt like this with e-mail, particularly against a target who is known to be paranoid in the first place and technically competent (e.g. Tankado). There is no way to hide the evidence, since the exploit code must be transmitted in full to the recipient. It will have passed (in uninterpreted, raw form) through multiple mail relays by then, including one or more mail filters (any one of which might quarantine the item for being suspicious), and thanks to financial sector rules like the Sarbanes-Oxley Act, an increasing number of companies are required by law to archive all of the mail they send or receive on write-once media (e.g. CDs or DVDs). Such archives would preserve the evidence indefinitely.

Post Extras: