Quoted Printable

[Julian Field]

    [ The following text is in the "ISO-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

It should already be doing that. It watches to see if it actually
applies the phishing messages to the email, and only then does it mark
the message for rebuild.

Roger Jochem wrote:

>This could work too...
>
>These messages didn't have any phishing attack on it. If they weren't
>rebuild, this would solve the problem...
>
>----- Original Message -----
>From: "Julian Field" <MailScanner at ECS.SOTON.AC.UK>
>To: <MAILSCANNER at JISCMAIL.AC.UK>
>Sent: Monday, February 21, 2005 9:15 AM
>Subject: Re: Quoted Printable
>
>
>
>
>>I specifically didn't make the phishing net do more than alter the
>>message if it needs to. If it doesn't detect a phishing attack, does it
>>still rebuild the message? I may well be able to stop it doing that if
>>it is.
>>
>>Roger Jochem wrote:
>>
>>
>>
>>>Too bad...
>>>
>>>In this case I would have to disable the Phising Detection...
>>>
>>>Could you consider doing an option of blocking, forwarding, deleting the
>>>phishing mails instead of changing the content of it (like spam)? The
>>>phishing mails found by clamav are already treated as virus, not
>>>
>>>
>forwarded,
>
>
>>>so I don't see any problem in blocking MailScanner's too... And this
>>>
>>>
>would
>
>
>>>be and option, some users would send the message with the changed body,
>>>another ones would block them. They could be sended to an single account
>>>with a modified subject like it's already done with spam, maybe
>>>"{Phishing?}".
>>>
>>>Another option would be to MailScanner modify only the header of the
>>>message, instead of the body, putting the "{Phishing?}" before the mail
>>>subject...
>>>
>>>
>>>
>>>
>>>
>>>>Yes. It's the message being rebuilt by MailScanner. Outlook Express
>>>>shouldn't be sending these things out as Quoted Printable, but use
>>>>base64 instead. This one is *very* hard for me to solve. We have already
>>>>put in an exception for most PDF files, these look like more problems.
>>>>
>>>>Roger Jochem wrote:
>>>>
>>>>
>>>>
>>>>
>>>>
>>>>>Hello, Julian!
>>>>>
>>>>>I made some tests with MailScanner to find out the problem with my
>>>>>Outlook Express Quoted Printable attachments that change size and
>>>>>format (between DOS and UNIX). I find out that if I disable the
>>>>>Phishing Detection the e-mails passes without any change to the
>>>>>attachment, and if I enable the Phishing Detection again, the file
>>>>>comes with the wrokg size and converted to Unix. Makes sense?
>>>>>
>>>>>
>>>>>
>>>>>
>>>>>
>>--
>>Julian Field
>>www.MailScanner.info
>>Buy the MailScanner book at www.MailScanner.info/store
>>
>>PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654
>>
>>------------------------ MailScanner list ------------------------
>>To unsubscribe, email jiscmail at jiscmail.ac.uk with the words:
>>'leave mailscanner' in the body of the email.
>>Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
>>the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>>
>>Support MailScanner development - buy the book off the website!
>>
>>
>
>------------------------ MailScanner list ------------------------
>To unsubscribe, email jiscmail at jiscmail.ac.uk with the words:
>'leave mailscanner' in the body of the email.
>Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
>the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>
>Support MailScanner development - buy the book off the website!
>
>
>

--
Julian Field
www.MailScanner.info
Buy the MailScanner book at www.MailScanner.info/store

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail at jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!