At 11:43 PM 12/15/01 -0500, Robert H Rosenbaum wrote the following: >I received what purports to be another piece of porn spam, but scattered >throughout are elements that make me wonder if it is something more >sinister. Does anyone here recognize the language, and is it executable >by any of the standard mail clients? > >The body of the email appears to be plain text, but inserted at random >places are six-character sequences that always consist of less-than, >exclamation-point, three-upper-case-letters, greater-than (in that >order). The three letters are different for each occurrence. Sometimes >these sequences occur in pairs, separated by one or more characters of >the underlying text; sometimes they occur alone; and once, two of them >are contiguous. The body also includes a few "<br>" elements, at >reasonable places to be interpreted as line breaks. > >I hesitate to quote a portion, or even to include one of the actual >sequences, in case they are harmful; but if anyone wants me to forward >the message to them off-list, I will. > >Any ideas? Am I being paranoid, or is this something common that I just >never noticed before?
Once upon a time I would have stated undeniably and categorically that plain ASCII text e-mail could not be dangerous. However, due to MS and there non-secure practices with IE/OE, this is not quite true any longer. Other browsers/e-mail products don't have these problems. If the message is sent in plain text but contains embedded scripts like Active X or Visual Basic scripting, then the scripts COULD be executed and cause problems. MS has "patched" IE and OE for these problems (until the next time one surfaces). HTML tags can be sent in plain text e-mail or as MIME encoded HTML e-mail. Hence the "blurring" of the plain text definition. Attachments are ALWAYS dangerous with any e-mail program. Most attachments are sent MIME encoded. Some are sent uuencoded others as plain text (rarely). If the message is sent truly as plain text (no embedded HTML tags or scripts), then it cannot be dangerous. The following file extensions might include a v*rus/w*rm/Tr*jan because their code will be executed by Windows and associated viewers or other MS programs, etc. unless otherwise prevented. (# indicates any numeric value) .EXE, .COM, .BAT, .DOC, .DOT, .SYS, .BIN, .XL#, .VXD, .MD#, .386, .RTF, .OBD, .DLL, .SCR, .PP#. .OBT, .POT, .OLE, .SHS, .MPP, .MPT, XTP, .XLB, .CMD, .OV#, .DEV, .VBS . What you have described is partially HTML encoded e-mail. Probably some character set other than US-ASCII or Windows iso-8859-1 that doesn't fully translate. I'd forget it and send it to the "bit bucket". Most of the porno e-mail is now coming from outside the US or at least the domains are registered elsewhere. Generally speaking, porno e-mail is usually to entice you to view a web site and sign up, not to "crash" your system. -- Gerry Boyd ============= PCWorks Mailing List ================= Don't see your post? Check our posting guidelines & make sure you've followed proper posting procedures, http://pcworkers.com/rules.htm Contact list owner <[EMAIL PROTECTED]> Unsubscribing and other changes: http://pcworkers.com =====================================================
