Cascading Spy Sheets: The Privacy & Security Implications of CSS in Emails
K.4.201 | Day 1 | 14:00 - 14:30 | Speakers: Leon Trampert, Daniel Weber, Michael Schwarz
Abstract
Cascading Style Sheets (CSS) enable visual customization of HTML emails. However, this flexibility comes at a cost: in this talk, we reveal how CSS creates serious privacy and security vulnerabilities. We demonstrate that CSS facilitates fingerprinting and tracking in HTML emails, even undermining the privacy protections offered by email clients that use proxy services to access remote resources. These tracking capabilities enable targeted phishing and spam campaigns.
More critically, we present a novel scriptless attack that exploits container queries, lazy-loading fonts, and adaptive ligatures to exfiltrate arbitrary plaintext from PGP-encrypted emails. The attack targets mixed-context scenarios—cases where email clients render both trusted (encrypted) and untrusted (attacker-controlled) HTML content within the same message view. We successfully demonstrate end-to-end exfiltration of PGP-encrypted text from Thunderbird, along with two other major email clients that permit such content mixing.
These findings expose fundamental gaps in current isolation mechanisms, demonstrating that post-Efail mitigations remain insufficient against CSS-based attacks.
Attachments
Speakers
Leon Trampert is a PhD student at the CISPA Helmholtz Center for Information Security under the supervision of Dr. Michael Schwarz and Prof. Christian Rossow. He likes to explore unintended security and privacy implications introduced by new Web standards. As such, he is interested in up-and-coming Web features such as WebAssembly or WebUSB. Leon has presented his work at various academic and industry conferences, including NDSS, ACM WWW, Black Hat Asia, and RuhrSec.
Daniel Weber is a PhD candidate researching in the field of microarchitectural attacks, such as side-channel and transient-execution attacks. His work focuses on automating the process of finding such attacks. Daniel gave presentations and trainings about his work on both, academic (e.g., USENIX, ESORICS) as well as industrial (e.g., Black Hat Europe/Asia/MEA, RuhrSec) conferences. He is part of Michael Schwarz' research group at the CISPA Helmholtz Center for Information Security. Before that, he obtained a Bachelor's degree in Cybersecurity from Saarland University. In his free time, Daniel participates in Capture the Flag competitions as part of the team saarsec.
Michael Schwarz is a tenured faculty at the CISPA Helmholtz Center for Information Security in Saarbruecken, Germany, with a focus on microarchitectural side-channel attacks and system security. He obtained his PhD with the title "Software-based Side-Channel Attacks and Defenses in Restricted Environments" in 2019 from Graz University of Technology. He holds two master's degrees, one in computer science and one in software engineering with a strong focus on security. He was part of the discovery of multiple CPU vulnerabilities, including Meltdown, Spectre, LVI, PLATYPUS, ZombieLoad, ÆPIC Leak, CacheWarp, Collide+Power, and GhostWrite. He was also part of the KAISER patch, the basis for Meltdown countermeasures now deployed in every modern operating system under names such as KPTI or KVA Shadow.
Links
External Links
Notice: The placeholder video image is licensed under CC BY-SA 4.0. The original image can be found hereChanges made to the image are: Cropped the image to a new ratio, part of the image was cut off.