Quoted Printable

[Roger Jochem]

    [ The following text is in the "iso-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

In 4.39.2-1? I downloaded it about an hour ago...


----- Original Message -----
From: "Julian Field" <MailScanner at ECS.SOTON.AC.UK>
To: <MAILSCANNER at JISCMAIL.AC.UK>
Sent: Monday, February 21, 2005 11:42 AM
Subject: Re: Quoted Printable


> It should already be doing that. It watches to see if it actually
> applies the phishing messages to the email, and only then does it mark
> the message for rebuild.
>
> Roger Jochem wrote:
>
> >This could work too...
> >
> >These messages didn't have any phishing attack on it. If they weren't
> >rebuild, this would solve the problem...
> >
> >----- Original Message -----
> >From: "Julian Field" <MailScanner at ECS.SOTON.AC.UK>
> >To: <MAILSCANNER at JISCMAIL.AC.UK>
> >Sent: Monday, February 21, 2005 9:15 AM
> >Subject: Re: Quoted Printable
> >
> >
> >
> >
> >>I specifically didn't make the phishing net do more than alter the
> >>message if it needs to. If it doesn't detect a phishing attack, does it
> >>still rebuild the message? I may well be able to stop it doing that if
> >>it is.
> >>
> >>Roger Jochem wrote:
> >>
> >>
> >>
> >>>Too bad...
> >>>
> >>>In this case I would have to disable the Phising Detection...
> >>>
> >>>Could you consider doing an option of blocking, forwarding, deleting
the
> >>>phishing mails instead of changing the content of it (like spam)? The
> >>>phishing mails found by clamav are already treated as virus, not
> >>>
> >>>
> >forwarded,
> >
> >
> >>>so I don't see any problem in blocking MailScanner's too... And this
> >>>
> >>>
> >would
> >
> >
> >>>be and option, some users would send the message with the changed body,
> >>>another ones would block them. They could be sended to an single
account
> >>>with a modified subject like it's already done with spam, maybe
> >>>"{Phishing?}".
> >>>
> >>>Another option would be to MailScanner modify only the header of the
> >>>message, instead of the body, putting the "{Phishing?}" before the mail
> >>>subject...
> >>>
> >>>
> >>>
> >>>
> >>>
> >>>>Yes. It's the message being rebuilt by MailScanner. Outlook Express
> >>>>shouldn't be sending these things out as Quoted Printable, but use
> >>>>base64 instead. This one is *very* hard for me to solve. We have
already
> >>>>put in an exception for most PDF files, these look like more problems.
> >>>>
> >>>>Roger Jochem wrote:
> >>>>
> >>>>
> >>>>
> >>>>
> >>>>
> >>>>>Hello, Julian!
> >>>>>
> >>>>>I made some tests with MailScanner to find out the problem with my
> >>>>>Outlook Express Quoted Printable attachments that change size and
> >>>>>format (between DOS and UNIX). I find out that if I disable the
> >>>>>Phishing Detection the e-mails passes without any change to the
> >>>>>attachment, and if I enable the Phishing Detection again, the file
> >>>>>comes with the wrokg size and converted to Unix. Makes sense?
> >>>>>
> >>>>>
> >>>>>
> >>>>>
> >>>>>
> >>--
> >>Julian Field
> >>www.MailScanner.info
> >>Buy the MailScanner book at www.MailScanner.info/store
> >>
> >>PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654
> >>
> >>------------------------ MailScanner list ------------------------
> >>To unsubscribe, email jiscmail at jiscmail.ac.uk with the words:
> >>'leave mailscanner' in the body of the email.
> >>Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
> >>the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
> >>
> >>Support MailScanner development - buy the book off the website!
> >>
> >>
> >
> >------------------------ MailScanner list ------------------------
> >To unsubscribe, email jiscmail at jiscmail.ac.uk with the words:
> >'leave mailscanner' in the body of the email.
> >Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
> >the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
> >
> >Support MailScanner development - buy the book off the website!
> >
> >
> >
>
> --
> Julian Field
> www.MailScanner.info
> Buy the MailScanner book at www.MailScanner.info/store
>
> PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654
>
> ------------------------ MailScanner list ------------------------
> To unsubscribe, email jiscmail at jiscmail.ac.uk with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>
> Support MailScanner development - buy the book off the website!

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail at jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!