Dodgy e-mail attachments from Microsoft.com
Joined: Sep 2002
Posts: 1,650
Likes: 0
From: Chichester, UK
Cynical? Haven't you just described "trusted computing"? Now that's worrying... 
Joined: Mar 2002
Posts: 448
Likes: 0
From: London, UK
Ahh, good old Ross. Always good value, ever since he debunked the cashpoint card/PIN security myth... 
Yes, I suppose what I said was. A bit more blatantly than TCI/Palladium, though
And yes, Palladium is very worrying...
Yes, I suppose what I said was. A bit more blatantly than TCI/Palladium, though
And yes, Palladium is very worrying...
Nice-but-dim
Joined: Sep 2001
Posts: 640
Likes: 0
From: Rural Yorkshire
I copped for the little blighter earlier this week. Suspected it, NAV (on auto update but with incoming mail scan disabled) caught it when I moved it to the desktop 'just to see what happened'.
Like others have said, if Norton can catch it, why can't reputable ISP's do the same?
Tim
Like others have said, if Norton can catch it, why can't reputable ISP's do the same?
Tim
Joined: Mar 2002
Posts: 448
Likes: 0
From: London, UK
Like others have said, if Norton can catch it, do the same?
If the question is really "why can't reputable ISP's all run Nroton [or equivalent] ?" then that's a separate issue, to which there are two parts:
1. Performance. Virus/anti-spam filtering consumes huge amounts of compute power. It is very expensive to build a resilient infrastructure that has adequate performance to do this. And many ISP will reason that it's more effective to have hundreds of their customers all complaining to the sender, rather than one ISP saying we've stopped a hundred copies of this virus/spam. Plus it's cheaper
2. Privacy vs. efficay. When I recently surveyed my user population (who are a very diverse bunch), by far the two most common responses I got were:
I Do anything you like as long as you stop the spam. I dont' even care if your block legitiamte email.
II How dare you intercept my mail. It is utterly unacceptable that there is even the faintest possibility that legitmate email may get blocked.
Of course, I got almost equal numbers supporting each position and I suspect that this would apply to most ISPs
Since it is not possible to satisfy both at the same time, many service providers take the easy option of not intercepting. Although it is the easy way out, it's not entirely obvious that it's the wrong thing to do. The issue of false positives (that is incorrectly identifying legitimate email as a spam or virus) is a significant one.
It's not at all obvious which is the right thing to do here. Perhaps it would be illuminating to run a poll on I and II to see what Pruners think... ?
Joined: Sep 1998
Posts: 513
Likes: 0
From: Sydney, Australia
RTFM,
My ISP filters spam with Spam Assassin, but as others have indicated, a lot gets through presumably to ensure that valid mail is not filtered. I can see filtering holes that could be plugged if the user could edit user-level filters.
eg,
- mail from myself - many spams have a "From" entry that consists of all or part of my username. I'd dump them if I could.
- mail with username or part of it in the subject line - that is rarely, if ever, valid mail.
- mail addressed to domains long passed away, but which were forwarded to a new domain at the time of old domain death. You need an option to dump "mail not to me". OK, you'd need a "friends list" as well to allow legitimate mail not personally addressed (eg from a mail-list) to pass.
These are just a few examples of many variable that I can think of, and while suitable for me, might cause problems for others.
So how about a "filter construction kit" as found in Mailwasher and the like, but to be applied at ISP level. Write your own personalised set of filter expressions applicable only to your account and upload it, or do it on an on-line form. Perhaps make the language a bit more understandable than Mailwasher's
, or like Mailwasher, have available downloadable filter files where the basic hard work has already been done by enthusiasts (or commercial entities who'd sell it - I'd pay!) and all you have to do is tweak it to suit your own username, etc.
It seems basic to me - there must be some reason why it hasn't been done.
AA
My ISP filters spam with Spam Assassin, but as others have indicated, a lot gets through presumably to ensure that valid mail is not filtered. I can see filtering holes that could be plugged if the user could edit user-level filters.
eg,
- mail from myself - many spams have a "From" entry that consists of all or part of my username. I'd dump them if I could.
- mail with username or part of it in the subject line - that is rarely, if ever, valid mail.
- mail addressed to domains long passed away, but which were forwarded to a new domain at the time of old domain death. You need an option to dump "mail not to me". OK, you'd need a "friends list" as well to allow legitimate mail not personally addressed (eg from a mail-list) to pass.
These are just a few examples of many variable that I can think of, and while suitable for me, might cause problems for others.
So how about a "filter construction kit" as found in Mailwasher and the like, but to be applied at ISP level. Write your own personalised set of filter expressions applicable only to your account and upload it, or do it on an on-line form. Perhaps make the language a bit more understandable than Mailwasher's
, or like Mailwasher, have available downloadable filter files where the basic hard work has already been done by enthusiasts (or commercial entities who'd sell it - I'd pay!) and all you have to do is tweak it to suit your own username, etc.It seems basic to me - there must be some reason why it hasn't been done.
AA
Joined: Jun 2000
Posts: 1,003
Likes: 0
From: Geriatrica, UK
AA, your first exclusion condition wouldn't do for me at the moment because, for synchronisation, I always Cc to myself every e-mail I send . I could change that by putting myself in the Primary addressee field.
So, we could then create a Rule in OE to block any messages with our own address as Cc. But No, any of our normal contacts could put us in as Cc Addressees.
But I lke your second idea and am now working on a Rule to block any messages with my own address in the subject title. For safety, I won't delete them, just make them "do not download from Server".
I'm now getting 20-30 junk mails getting through with another 20-30 blocked by BTOpenworld Spam Filter.
[edited to eliminate gibberish]
Cheers, fob
So, we could then create a Rule in OE to block any messages with our own address as Cc. But No, any of our normal contacts could put us in as Cc Addressees.
But I lke your second idea and am now working on a Rule to block any messages with my own address in the subject title. For safety, I won't delete them, just make them "do not download from Server".
I'm now getting 20-30 junk mails getting through with another 20-30 blocked by BTOpenworld Spam Filter.
[edited to eliminate gibberish]
Cheers, fob
Last edited by fobotcso; 25th May 2003 at 05:53.
Official PPRuNe Chaplain
Joined: Apr 2001
Posts: 3,498
Likes: 0
From: Witnesham, Suffolk
I've found a good solution. I have all my incoming mail routed via Spamcop. That sent me a message yesterday about a virus with a forged "from" address of [email protected] that it had shredded. Several times, in fact.
The Spamcop filter can be "personalised" in a variety of ways, including personal blacklists and whitelists. I have all e-mail from China, Hong Kong, Taiwan, Korea, Brazil and Argentina treated as Spam, as well as verizon.net and some other ISPs of that ilk.
I get very little spam indeed with that setup. Every couple of days I check the "filters" to see if there's anything genuine in there, then "spamcop" the rest.
Sadly, I blacklisted hotmail.com - which meant an e-mail from AerBabe sat in the filters for a day or so :-( She's "whitelisted" now...
The Spamcop filter can be "personalised" in a variety of ways, including personal blacklists and whitelists. I have all e-mail from China, Hong Kong, Taiwan, Korea, Brazil and Argentina treated as Spam, as well as verizon.net and some other ISPs of that ilk.
I get very little spam indeed with that setup. Every couple of days I check the "filters" to see if there's anything genuine in there, then "spamcop" the rest.
Sadly, I blacklisted hotmail.com - which meant an e-mail from AerBabe sat in the filters for a day or so :-( She's "whitelisted" now...
Joined: Nov 2000
Posts: 66
Likes: 0
From: australia
Got one today from "microsoft.com" .........re movie,
and as I'd been to the Microsoft website recently to download I thought it might be in connection with that, but my anti virus warned of a worm virus instead !!
No attachment.
and as I'd been to the Microsoft website recently to download I thought it might be in connection with that, but my anti virus warned of a worm virus instead !!
No attachment.
Joined: May 1999
Aviation Qualifications: ATP+Mil
Posts: 27,397
Likes: 857
From: Quite near 'An aerodrome somewhere in England'
With the odd billion dollars at his disposal, I hope that Bill Gates has been told about this abuse of the 'microsoft.com' name and is quietly tracking down the perpetrator.......
In the UK, there are rewards which can be paid to you for turning in the identities of people using pirated software. How about rewards being payable to legitimate ISP operators who track down these spammers, Bill?
In the UK, there are rewards which can be paid to you for turning in the identities of people using pirated software. How about rewards being payable to legitimate ISP operators who track down these spammers, Bill?
