I implemented the three header filters which I suggested last night
(see last message in this message) and sent the following "education
piece" out to all of my users today - encouraging them to share this
information with their email correspondents. I'm sure this can be
improved upon, but it is a first step in "user education."
CONFIGURE YOUR EMAIL SOFTWARE
TO SEND "PLAIN TEXT" MESSAGES
The Mail Server has been configured to automatically
reject messages which contain HTML or styled-text. Rejecting
messages which appear to contain either HTML tags (codes) or
"styled text" is part of our strategy to prevent the use of
email to distribute viruses and malicious executable code to
our department's computers and servers.
You will need to disable any HTML or styled-text options in
your email software prior to submitting messages to our users.
You might use the Help feature to look for HTML, styled-text
(with and without the hyphen), plain text, and ASCII text.
If necessary, contact the email software company's support
staff or a knowledgeable colleague for assistance. You may
find the following examples helpful.
Forcing "Plain Text" in Netscape Messenger 4.5 - 4.73 (Windows):
Start Netscape.
Go to EDIT then PREFERENCES then MAIL & NEWSGROUPS.
Click FORMATTING.
Click the setting for "...plain text editor..." as well
as the setting for "Convert the message into plain
text..."
Go to IDENTITY (under Mail & Newsgroups).
Make sure there is no check in the box beside "Attach my
personal card to messages (as a vCard)." At times, we
block messages with attachments, and a vCard is sent
in the form of an attachment.
Then click the OK button as many times as it takes to get
back to the regular Netscape screen.
Forcing "Plain Text" in Eudora Pro 4.1 (Windows):
Run Eudora Pro.
Go to TOOLS then OPTIONS.
Click STYLED TEXT.
Click the radio button beside "Send plain text only."
Click the OK button to return to the regular Eudora Pro
screen.
Note: "Styled Text" settings do not exist in Eudora Pro
version 4.0 and earlier. Users of earlier versions
of Eudora Pro may want to consider upgrading to the
newest release of Eudora Pro.
Setting "Plain Text" in Microsoft Outlook (Windows) does not
work, but "Rich Text" seems to work with some email servers:
Microsoft's Outlook has options which suggest that
"plain text" can be sent, but Outlook will not
fully honor such settings.
Outlook gives you four mail editor options, one of which
is the HTML editor - and HTML is what is causing
your message to be rejected. Follow these steps to
switch to "Rich Text" format:
Run Outlook.
Click on TOOLS then OPTIONS.
Click MAIL FORMAT tab.
In first row, "message format," you will probably
see "HTML."
Open the list and click on MS OUTLOOK RICH TEXT
FORMAT.
Click APPLY and then OK at the bottom.
These are the only email programs for which I have "plain text"
solutions. If you use a different email program, the examples
above or your product's Tech Support staff may be helpful as
you attempt to configure your program to send only "plain text"
email messages.
Gordon Williams
Counseling Center
Michigan State University
-----
mike delp wrote:
>
> We are going to implement a temporary filter, and education program for our
> users. We will announce that for one week, we will filter all html e-mails,
> and then release the filter. We will be broadcasting the problem and fixes
> to our users, and give them a chance to get protected before \we open it up
> again.
>
> QUESTION: There is a utility that will distribute the forward file to all
> users mail boxes, does anybody have that link??
>
> My .02
>
> Mike Delp
> Director of Technical Services
> Database Computer Group, Inc.
> (515) 564-0150
> FAX- (515) 564-0152
> [EMAIL PROTECTED]
>
> -----Original Message-----
> From: Ryan C. LaMarre [mailto:[EMAIL PROTECTED]]
> Sent: Wednesday, July 19, 2000 10:12 AM
> To: [EMAIL PROTECTED]
> Subject: RE: [IMail Forum] FW: MS vulnerability
>
> I think filtering out ALL html mail is a little harsh, don't you think?
> Wouldn't a little user education and disabling the preview pane be a more
> user-friendly approach?
>
> Just my 2 bits.
>
> Ryan LaMarre
> Computer Support Specialist
> Unity College
> Unity, ME 04988
> (207) 948-3131 x298
> [EMAIL PROTECTED]
>
> -----Original Message-----
> From: [EMAIL PROTECTED]
> [mailto:[EMAIL PROTECTED]]On Behalf Of Dan Shadix
> Sent: Tuesday, July 18, 2000 7:06 PM
> To: IMail_Forum
> Subject: [IMail Forum] FW: MS vulnerability
>
> I thought that this was important enough to post on the forum and I haven't
> seen it mentioned here.
>
> SANS Issued a FLASH message today describing a vulnerability that is
> probably the most dangerous programming error in Windows workstation (all
> varieties -- 95, 98, 2000, NT 4.0) that Microsoft has made.
> You are vulnerable to total compromise simply by previewing or reading an
> email (without opening any attachments) if you have one of the affected
> operating systems and have the following installed:
>
> Microsoft Access 97 or 2000
> Internet Explorer 4.0 or higher, including 5.5 (Windows 2000 includes IE 5)
>
> Go to http://www.sans.org/newlook/resources/win_flaw.htm for complete
> details.
>
> I have started filtering out HTML mail by looking for the html tag and head
> tag (brackets removed so my filter doesn't block this) in message bodies.
> Am I correct that this will catch all HTML e-mail, and if not what do I need
> to look for?
My message from last night:
Dan,
I don't know that this method is any better than yours, but this is
another approach to filtering all HTML messages. Remove all six
instances of capital Z in the following three lines, then place the
three lines in your rules.ima file. Change "trapped" to whatever
you are using (if not NUL):
H~ContZent-Type: text/htZml:trapped
H~ContZent-Type: text/enZriched:trapped
H~ContZent-Type: multipart/alZternative:trapped
Perhaps others can comment on the pros & cons of these two different
approaches to "trapping" all HTML mail.
Gordon
-----
Please visit http://www.ipswitch.com/support/mailing-lists.html
to be removed from this list.
An Archive of this list is available at:
http://www.mail-archive.com/imail_forum%40list.ipswitch.com/
