Quoted Printable

[Julian Field]

    [ The following text is in the "ISO-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

Yes. But to be sure you will have to switch off all the HTML content checks.

Roger Jochem wrote:

>In 4.39.2-1? I downloaded it about an hour ago...
>
>
>----- Original Message -----
>From: "Julian Field" <MailScanner at ECS.SOTON.AC.UK>
>To: <MAILSCANNER at JISCMAIL.AC.UK>
>Sent: Monday, February 21, 2005 11:42 AM
>Subject: Re: Quoted Printable
>
>
>
>
>>It should already be doing that. It watches to see if it actually
>>applies the phishing messages to the email, and only then does it mark
>>the message for rebuild.
>>
>>Roger Jochem wrote:
>>
>>
>>
>>>This could work too...
>>>
>>>These messages didn't have any phishing attack on it. If they weren't
>>>rebuild, this would solve the problem...
>>>
>>>----- Original Message -----
>>>From: "Julian Field" <MailScanner at ECS.SOTON.AC.UK>
>>>To: <MAILSCANNER at JISCMAIL.AC.UK>
>>>Sent: Monday, February 21, 2005 9:15 AM
>>>Subject: Re: Quoted Printable
>>>
>>>
>>>
>>>
>>>
>>>
>>>>I specifically didn't make the phishing net do more than alter the
>>>>message if it needs to. If it doesn't detect a phishing attack, does it
>>>>still rebuild the message? I may well be able to stop it doing that if
>>>>it is.
>>>>
>>>>Roger Jochem wrote:
>>>>
>>>>
>>>>
>>>>
>>>>
>>>>>Too bad...
>>>>>
>>>>>In this case I would have to disable the Phising Detection...
>>>>>
>>>>>Could you consider doing an option of blocking, forwarding, deleting
>>>>>
>>>>>
>the
>
>
>>>>>phishing mails instead of changing the content of it (like spam)? The
>>>>>phishing mails found by clamav are already treated as virus, not
>>>>>
>>>>>
>>>>>
>>>>>
>>>forwarded,
>>>
>>>
>>>
>>>
>>>>>so I don't see any problem in blocking MailScanner's too... And this
>>>>>
>>>>>
>>>>>
>>>>>
>>>would
>>>
>>>
>>>
>>>
>>>>>be and option, some users would send the message with the changed body,
>>>>>another ones would block them. They could be sended to an single
>>>>>
>>>>>
>account
>
>
>>>>>with a modified subject like it's already done with spam, maybe
>>>>>"{Phishing?}".
>>>>>
>>>>>Another option would be to MailScanner modify only the header of the
>>>>>message, instead of the body, putting the "{Phishing?}" before the mail
>>>>>subject...
>>>>>
>>>>>
>>>>>
>>>>>
>>>>>
>>>>>
>>>>>
>>>>>>Yes. It's the message being rebuilt by MailScanner. Outlook Express
>>>>>>shouldn't be sending these things out as Quoted Printable, but use
>>>>>>base64 instead. This one is *very* hard for me to solve. We have
>>>>>>
>>>>>>
>already
>
>
>>>>>>put in an exception for most PDF files, these look like more problems.
>>>>>>
>>>>>>Roger Jochem wrote:
>>>>>>
>>>>>>
>>>>>>
>>>>>>
>>>>>>
>>>>>>
>>>>>>
>>>>>>>Hello, Julian!
>>>>>>>
>>>>>>>I made some tests with MailScanner to find out the problem with my
>>>>>>>Outlook Express Quoted Printable attachments that change size and
>>>>>>>format (between DOS and UNIX). I find out that if I disable the
>>>>>>>Phishing Detection the e-mails passes without any change to the
>>>>>>>attachment, and if I enable the Phishing Detection again, the file
>>>>>>>comes with the wrokg size and converted to Unix. Makes sense?
>>>>>>>
>>>>>>>
>>>>>>>
>>>>>>>
>>>>>>>
>>>>>>>
>>>>>>>
>>>>--
>>>>Julian Field
>>>>www.MailScanner.info
>>>>Buy the MailScanner book at www.MailScanner.info/store
>>>>
>>>>PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654
>>>>
>>>>------------------------ MailScanner list ------------------------
>>>>To unsubscribe, email jiscmail at jiscmail.ac.uk with the words:
>>>>'leave mailscanner' in the body of the email.
>>>>Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
>>>>the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>>>>
>>>>Support MailScanner development - buy the book off the website!
>>>>
>>>>
>>>>
>>>>
>>>------------------------ MailScanner list ------------------------
>>>To unsubscribe, email jiscmail at jiscmail.ac.uk with the words:
>>>'leave mailscanner' in the body of the email.
>>>Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
>>>the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>>>
>>>Support MailScanner development - buy the book off the website!
>>>
>>>
>>>
>>>
>>>
>>--
>>Julian Field
>>www.MailScanner.info
>>Buy the MailScanner book at www.MailScanner.info/store
>>
>>PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654
>>
>>------------------------ MailScanner list ------------------------
>>To unsubscribe, email jiscmail at jiscmail.ac.uk with the words:
>>'leave mailscanner' in the body of the email.
>>Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
>>the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>>
>>Support MailScanner development - buy the book off the website!
>>
>>
>
>------------------------ MailScanner list ------------------------
>To unsubscribe, email jiscmail at jiscmail.ac.uk with the words:
>'leave mailscanner' in the body of the email.
>Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
>the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>
>Support MailScanner development - buy the book off the website!
>
>
>

--
Julian Field
www.MailScanner.info
Buy the MailScanner book at www.MailScanner.info/store
Professional Support Services at www.MailScanner.biz
MailScanner thanks transtec Computers for their support

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail at jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!