Phishing detection and outbind:
Paul.Haldane at NEWCASTLE.AC.UK
Thu Jul 21 17:01:00 IST 2005
4.43.2-1 (it's the systems that Quentin looks after - I just happen to be interested in this particular question :->).
> -----Original Message-----
> From: Julian Field
> Sent: 21 July 2005 16:40
> To: MailScanner mailing list
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
> What version of MailScanner are you using?
> On 21 Jul 2005, at 11:53, Paul Haldane wrote:
> > We've got an issue (I don't like to call it a problem because
> > MailScanner is doing the right thing :->) with messages
> from Outlook
> > clients (I believe it's always Outlook) containing things like
> > www.ncl.ac.uk (as opposed to properly formed URLs like
> > http://www.ncl.ac.uk/) and the phishing detection code.
> > Here's an example (after going passing through MailScanner
> - haven't
> > yet managed to capture an untouched version) ...
> >> programme has been developed. This is available on the website -
> >> <outbind://22/www.ncl.ac.uk/internal/e2r>
> >> MailScanner has detected a possible fraud attempt from "outbind:"
> >> claiming to be www.ncl.ac.uk/internal/e2r
> > I've tried (quite hard) to persuade Outlook to generate messages
> > containing outbind hrefs but haven't yet managed so either
> it's not as
> > simple as I thought or the version/setup of Outlook I'm
> using doesn't
> > do it.
> > Does anyone know exactly how to provoke this behaviour (and by
> > implication how to avoid it)?
> > Would it be sensible/possible to treat this sort of URL specially
> > (stripping off ^outbind://\d+/ ?) so that the phishing code
> is happy
> > with it?
> - --
> Julian Field
> Buy the MailScanner book at www.MailScanner.info/store PGP
> footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654
> -----BEGIN PGP SIGNATURE-----
> Version: PGP Desktop 9.0.1 (Build 2185)
> -----END PGP SIGNATURE-----
------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail at jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the Wiki (http://wiki.mailscanner.info/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
Support MailScanner development - buy the book off the website!
More information about the MailScanner