Can just opening an email download both viruses and spyware?

This whole “can I get a virus just by reading email” question has been
around a very long time. These days it’s not really much of a risk at all, but
once upon a time there was a very real danger.

And, of course, you can still face that risk with a misconfigured email
program.

Part of the question being asked here also is would spyware be any
different?

]]>
<![CDATA[

In a word: no.

In all honesty, the line between viruses and spyware has become so blurred that it’s almost impossible to draw a distinction between the two. Spyware often propagates in the form of viruses, and viruses often install spyware. Which is which, and what’s what is pretty academic and, in my opinion, just not that important to the average user.

With the exception, of course, that you do need both anti-virus and anti-spyware protection, as the tools use different techniques to target what they protect you from. And yes, it’s doubly confusing since many anti-virus programs will trap some spyware, and conversely many anti-spyware tools will eliminate some viruses.

The real takeaway to remember to keep yourself safe is simply: don’t worry about the differences, and make sure you have protection from both.

Now, back to email.

Long, long ago (in internet time – maybe 5 years or more in “real” time), email programs would, when you open a message, display all the content in that message. That included not only pictures but if the message was HTML then many would also do things like run any Javascript that was part of the message.

As a result, malware (a term that encompasses both viruses and spyware) was created that would leverage HTML, or Javascript, or even simply display images – often along with known operating system vulnerabilities – to actually attempt to infect your machine if a specifically crafted malicious email message were simply displayed. That got even worse with the advent of the preview pane in many email programs, which would display your incoming email even if you had stepped away from your computer.

You could get infected just by looking, and you didn’t even have to be there to look!

Yikes!

Needless to say, that was (relatively) quickly addressed by most of the email programs with a few not-so-subtle changes:

• Javascript was typically not supported when email was displayed.

• Images were not displayed by default.

• Vulnerabilities were patched.

• Spam filters also started to take on the role of simple virus checkers, and would junk email with suspicious content.

• And of course anti-malware software began checking email as it arrived.

I’m sure you’re at least familiar with the image blocking step since it’s something you see frequently today. In almost all popular email programs images will not be displayed in an email unless that email is from someone you’ve indicated you trust.

Unless you explicitly turn them off, there are now enough safeguards in place with modern email programs and web based email services that the chances of getting infected by simply viewing an email are extremely remote. Most malware authors have moved on to techniques that are apparently much more successful.

Like tricking you into clicking a link, or opening an attachment.

When that happens, and it’s a malicious link or attachment – all bets are off.