How can I safely open a suspicious email?

Question

Suppose I receive an email that I highly suspect is some form of spam but I'm not 100% sure. Suppose also that I'm using form of webmail (like Gmail) with good spam filters, but this message made it through safely.

Obviously I should not open any attachments, but is this email otherwise safe to open? If not, is there a simple way to safely open it?

Answer 1

If you open the email in a web client (ie, online at gmail.com or mail.yahoo.com, etc), you're generally very unlikely to experience any problems. If this email contained a script virus (very rare nowadays) it would generally require being opened in an email client locally installed on the computer in order to gain sufficient access to actually infect your computer.

Viruses, because of the popularity of web clients for email, have pretty much stopped sending themselves as emails in the last few years.

Spam is still a problem, and many viruses create spambots and enslave their infected computers as spam relays. But you're not going to catch a virus from the average spam message.

If you are using a local email client, don't open suspicious emails unless you've got the email client running inside a virtualized system that you can scrub easily with a reset.

Answer 2

If you want to be really safe, you can install a virtual machine and an operating system on it so that you can open the files there, this way it doesn't affect your OS if something goes wrong.

Answer 3

Another option (which might not be possible with all e-mail clients) is to open the e-mail as plain text. This might be an option like "View source" for example.

This may give you something that's hard for a human to read as the message is buried in HTML coding, but there's no chance that any scripts will be run or files downloaded/opened from remote websites.

Answer 4

My suggestion is to download Sandboxie.

Run your email client and attachments inside the Sandbox.

Sandboxie runs your programs in an isolated space which prevents them from making permanent changes to other programs and data in your computer.

The red arrows indicate changes flowing from a running program into your computer. The box labeled Hard disk (no sandbox) shows changes by a program running normally. The box labeled Hard disk (with sandbox) shows changes by a program running under Sandboxie. The animation illustrates that Sandboxie is able to intercept the changes and isolate them within a sandbox, depicted as a yellow rectangle. It also illustrates that grouping the changes together makes it easy to delete all of them at once.

Answer 5

Use a livecd - check the mail there, and if anything gets through, you can either upload it somewhere for checking, or simply switch off the system.

You could even try opening the attachments in this case, just for amusement's sake.

Answer 6

Gmail blocks images from unknown senders by default. We also scan for viruses and other suspicious content. If you're concerned about a suspicious message, don't display the images when you open it or download any attachments. You can also report the message to Gmail either for spam or for phishing.