Phishing problem.

[Tony Enderby]

    [ The following text is in the "iso-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

Julian,
 
Made the requested change to MailScanner.conf and then attempted to
trigger with a well formed phish and the subject was not modified to
insert (Fraud?)
 
Would running MS in debug mode as Martin suggested be worthwhile?
 
Tony.
      ----- Original Message -----
From: Julian Field
To: MAILSCANNER at JISCMAIL.AC.UK
Sent: Monday, November 28, 2005 10:00 PM
Subject: Re: Phishing problem.

Try setting "Phishing Modify Subject = yes" in MailScanner.conf and
let me know what happens. I have an idea of what it might be. At
some point in the last month or 2, CVS "lost" an edit (CVS is the
package that manages the source code tree). MessageBatch.pm was
therefore missing a function.
Upgrade to the latest beta and let me know what happens. This may
well fix it.

On 28 Nov 2005, at 10:45, Tony Enderby wrote:

      Hi All,
 
I have read some posts in the list archive regarding phishing
fraud detection and one in particular about a user who
couldn't get the functionality working but there was no
definitive answer so I thought I'd ask again.
 
I have been unable to get phishing detection to trigger
(insert highlight) with MS v 4.47.4 or the two previous
stable releases.   I have dangerous content scanning set to
on and although originally had 'find phishing fraud" set to a
ruleset, have also tried hard coding to '"yes" both with the
same result.
 
I have tried manually firing the phishing detection by
sending hand coded html email from various external sources
(not on phishing whitelist) with disparate text and URL
links, and also copied examples from various "phishing
sample" websites.  The numeric phishing detection does also
not seem to work with the most simple email I've compiled and
sent containing the following entry <a
href=numericlinkwarning
http://203.203.45.45>http://www.test.net</a> but MS lets them
through without inserting the warning.
 
The folloing entries appears in my MailScanner.conf
 
Find Phishing Fraud = yes
Also Find Numeric Phishing = yes
Highlight Phishing Fraud = yes
 
A copy of terminal output from MailScanner -v is included
below in the hope that maybe I'm missing some HTML parser
module which is required to do the phishing checks.

Any help would be much appreciated.
 
Tony.
 
This is Perl version 5.008005 (5.8.5)
 
This is MailScanner version 4.47.4
Module versions are:
1.00    AnyDBM_File
1.14    Archive::Zip
1.03    Carp
1.119   Convert::BinHex
1.00    DirHandle
1.05    Fcntl
2.73    File::Basename
2.08    File::Copy
2.01    FileHandle
1.06    File::Path
0.14    File::Temp
1.29    HTML::Entities
3.45    HTML::Parser
2.30    HTML::TokeParser
1.21    IO
1.10    IO::File
1.123   IO::Pipe
1.50    Mail::Header
3.05    MIME::Base64
5.417   MIME::Decoder
5.417   MIME::Decoder::UU
5.417   MIME::Head
5.417   MIME::Parser
3.03    MIME::QuotedPrint
5.417   MIME::Tools
0.10    Net::CIDR
1.08    POSIX
1.77    Socket
0.05    Sys::Syslog
1.02    Time::localtime
 
Optional module versions are:
0.17    Convert::TNEF
1.809   DB_File
1.08    Digest
1.01    Digest::HMAC
2.33    Digest::MD5
2.01    Digest::SHA1
missing Inline
missing Mail::ClamAV
3.000004        Mail::SpamAssassin
missing Mail::SPF::Query
missing Net::CIDR::Lite
0.23    Net::DNS
0.31    Net::LDAP
missing Parse::RecDescent
missing SAVI
missing Sys::Hostname::Long
2.42    Test::Harness
0.47    Test::Simple
1.95    Text::Balanced
1.19    URI

------------------------ MailScanner list
------------------------
To unsubscribe, email jiscmail at jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the Wiki (http://wiki.mailscanner.info/)
and the archives
(http://www.jiscmail.ac.uk/lists/mailscanner.html). 

Support MailScanner development - buy the book off the
website!


-- 
Julian Field
www.MailScanner.info
Buy the MailScanner book at www.MailScanner.info/store
PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654


------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail at jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the Wiki (http://wiki.mailscanner.info/)
and the archives
(http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail at jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the Wiki (http://wiki.mailscanner.info/)
and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!