Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

This question already has an answer here:

Why does viewing an image in a web browser or any other email can pose a security concern? Do some viruses pose as images?

share|improve this question

marked as duplicate by slhck May 2 '13 at 20:59

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

up vote 2 down vote accepted

Actually it is one of very common method to spread virus. And a quick Google will show many many forums and blogs discussing about how it is being done. I am posting few here,

But as long as you don't open image there is no way a virus code can get executed.

share|improve this answer
How come websites do not have this issue, but only email? – agz May 3 '13 at 7:01
I am no expert in this matter :) ... but I think when you view an image online you are actually downloading that image temporarily on your system and because of that you could get infected if you system is not well protected (like un-updated OS, no AV, use of IE :) etc) – JackLock May 3 '13 at 12:56
+1 for "use of IE" – agz May 10 '13 at 3:25

I believe you are referring to the fact some email viewers block the downloading of images in HTML emails. This isnt so much a security concern, but a profanity filter. If the email client sees an email with images as from an unverified source, it will block the images from downloading as it might contain images that some find offensive (porn spam). This feature should be able to be disabled in every email client and allow all images to be downloaded with the mail.

share|improve this answer
The usual reason to not download images immediately is to save time and bandwidth while opening mail. – chepner May 2 '13 at 20:45
If I open an HTML file, and it opens an Image, it leaves a log somewhere. This means I leak info that the image was opened. If I give a globally unique filename, then I know when that particular email was opened. If I'm a spammer, this info leak is valuable. I can also set cookies. – Rich Homolka May 2 '13 at 21:11
It also is for privacy - downloading the image generates a web-request which will be tracked by certain email marketing campaign generators. You therefore have told them that the email address is valid and that you opened the email. – James May 2 '13 at 21:14

In its infinite wisdom, some versions of Windows show a file named e.g. xyz.jpg.exe as if it was an image (JPEG), you ask to open it, and it is run as it is an executable... game over.

The image formats are quite complex, and so are the programs/libraries that process them. There have been bad bugs in those. Add that the images gotten via email/WWW are (by definition) from untrusted sources, that a bug can very well lead to run code specified by the attacker and loaded into the image, and you are in the exactly same situation as above.

share|improve this answer
How come websites do not have this issue, but only email? – agz May 3 '13 at 7:01

Not the answer you're looking for? Browse other questions tagged .