New phishing tactic falling through the net

[John Wilcock]

    [ The following text is in the "ISO-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

Julian Field wrote:
> Message.pm patch attached which implements this trap. That was a
> toughie, took me 45 minutes!

Not sure whether you're being sarcastic about the toughness or not :-)
Anyway, it doesn't seem to be working properly.

I sent it the following (telnetting in and making it up as I go along!):

> <a href="http://www.example.yourbank.com/">
> <map name="mymap"><area coords="0,0,100,100" shape="rect"  href="http://www.example.phisher.com/hook"></map>
> <img src="http://whatever" usemap="#mymap"></a>

MS clearly noticed *something*, because there's an extra </map> in what
I got back:

> <a href="http://www.example.yourbank.com/"></map>
> <map name="mymap"><area coords="0,0,100,100" shape="rect"  href="http://www.example.phisher.com/hook">
> <img src="http://whatever" usemap="#mymap"></a>

John.

--
-- Over 2500 webcams from ski resorts around the world - www.snoweye.com
-- Translate your technical documents and web pages    - www.tradoc.fr

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail at jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!