A novel type of attack utilizing CSS code has emerged, transforming standard HTML emails into tools for capturing user credentials. This new method, not dependent on JavaScript or conventional malware, poses significant risks to webmail users.
Understanding CSS Bomb Attacks
Known as ‘CSS bomb’ attacks, this technique turns the formatting features of major webmail services into mechanisms for covertly logging user input. These attacks can capture typed passwords by exploiting trusted HTML and CSS features.
Gareth Heyes, a researcher at PortSwigger, investigated how webmail clients like Gmail, Outlook, and others process incoming HTML and CSS. These clients attempt to sanitize code to remove security threats while maintaining visual integrity. However, the divergence between what is sanitized and what browsers display can be manipulated by attackers.
Exploiting Webmail Client Vulnerabilities
By taking advantage of CSS quirks, such as mutation and certain selectors, attackers can create deceptive interfaces that mimic password fields. As users type, each keystroke is captured and sent to a server controlled by the attacker, effectively logging the information without detection.
This method overcomes previous limitations of CSS keyloggers, which struggled to update HTML attributes in real-time. The latest research demonstrates how select elements and HTML labels can be misused to create a functioning password-stealing tool within emails.
Implications and Protective Measures
Demonstrations of these tactics showed vulnerabilities in platforms like Outlook and Fastmail. In some cases, CSS bugs allowed complete takeover of the email window, enabling attackers to present fake login screens or track email interactions.
Despite some vulnerabilities being patched, unresolved issues persist, particularly in Outlook. Security experts suggest that webmail services should implement sandboxed iframes, block automatic image loading, and restrict risky CSS selectors to mitigate these threats.
For users, disabling auto-loaded remote content and remaining cautious of unexpected login prompts in emails are effective preventive measures against these sophisticated attacks. Awareness and vigilance remain crucial as these threats continue to evolve.
