How CSS Can Enable Attacks Through HTML Email
· 5:49 · Watch on YouTube ↗
Summary
Web security researcher Gareth Hayes describes how CSS in email can enable data exfiltration and interface spoofing, and recommends strict HTML/CSS sanitization, sandboxed iframes, and limiting external requests.
Key points
- Gareth Hayes says CSS can be used in email to steal passwords, exfiltrate tokens, spoof interfaces, and deface websites.
- He warns that CSS-based techniques may bypass some Content Security Policy protections.
- Hayes recommends rendering messages in sandboxed iframes to limit attacks and prevent reconnaissance of the message window.
- He advises sanitizing both HTML and CSS and restricting external requests from email content.
- Hayes says he plans to release a toolkit related to CSS weaponization, but the video does not name it.
Article Details
- Topics
- [00:00] CSS as a means to steal passwords and exfiltrate tokens
- [00:31] Gareth Hayes's research and CSS-based attacks in webmail
- [02:25] Email as an attack vector and CSS techniques that may bypass CSP
- [03:14] Defenses for email security, including sandboxed iframes and sanitization
- [04:05] Sharing CSS attack research and a planned toolkit
- [05:05] Strict isolation and restrictions for HTML email