Mailto's being marked as detected fraud attempt (text->RTF/HTML conversion problem)

[Quentin Campbell]

Julian

Thanks for that. I will not try it out today as I have reverted to the
4.35.11-1 Message.pm to get a breathing space from user complaints.

The next step is to control the application of the phishing net by using
a MS ruleset as Martin Hepworth is doing. We will exempt our outgoing
mail traffic.

Then I can go back to the modified Message.pm and try your latest
version.

I have confirmed that it is the text -> RTF convertor used by
Outlook/Exchange version 6.5.6944.0 that is converting
('www.ncl.ac.uk/...)' to '(</FONT><A
HREF=3D"file=://www.ncl.ac.uk..."></U></FONT></U><U><U>FONT
COLOR=3D"#0000FF" ...'   

AND in addition it converts 'E-mail: c.d.ingram at ncl.ac.uk' to 'E-mail:
</FONT><A HREF=3D"mailto:c.d.ingram at ncl.ac.uk"></FONT></U><U><FONT
COLOR=3d"#0000FF" ...'

If he uses the same signature as part of an HTML message the URL is left
as-is but the "E-mail: c.d.ingram at ncl.ac.uk" is converted similarly to
that which takes place for RTF.

I will send separately copies of the same signature lines as received:

1. in a plain text message
2. in an RTF message
3. in an HTML message
   
Quentin
---
PHONE: +44 191 222 8209    Information Systems and Services (ISS),
                           University of Newcastle,
                           Newcastle upon Tyne,
FAX:   +44 191 222 8765    United Kingdom, NE1 7RU.
------------------------------------------------------------------------
"Any opinion expressed above is mine. The University can get its own."  

>-----Original Message-----
>From: MailScanner mailing list 
>[mailto:MAILSCANNER at JISCMAIL.AC.UK] On Behalf Of Julian Field
>Sent: 17 November 2004 15:05
>To: MAILSCANNER at JISCMAIL.AC.UK
>Subject: Re: Mailto's being marked as detected fraud attempt.
>
>Please try the attached Message.pm file. It's a 1-line change 
>that should do
>the trick.
>
>On 17/11/04 2:05 pm, "Quentin Campbell" <Q.G.Campbell at NEWCASTLE.AC.UK>
>wrote:
>> Julian
>>
>> One bit of help would be considering exempting 'href="file:www...."'
>> tags.
>>
>> It appears that in some circumstances Outlook/Exchange 
>converts the URL
>> www.ncl.ac.uk/research/institutes/ionslides into
>> 'href="file:www.ncl.ac.uk/research/institutes/ionslides"' rather than
>> 'href="http://www.ncl.ac.uk/research/institutes/ionslides"'.
>
>
>--
>Julian Field
>www.MailScanner.info
>Buy the MailScanner book at www.MailScanner.info/store
>
>PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654
>
>
>------------------------ MailScanner list ------------------------
>To unsubscribe, email jiscmail at jiscmail.ac.uk with the words:
>'leave mailscanner' in the body of the email.
>Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
>the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>
>Support MailScanner development - buy the book off the website!
>
>

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail at jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!