"Opening" email attachments

[kayofcircles]

I am running 98 and using Outlook Express 5. Have my OE set with a "Preview" pane. I click on a new message, and it displays in the Preview pane. Very rarely, I receive an attachment that does not open in the Preview pane..and have to decide whether or not to open it. Have always assumed that those are the ones that might be dangerous. My (maybe stupid) question is..am I "opening" attachments only when I choose "open", or am I always opening those other attachments too that show in the Preview pane? Last week I received an email from someone I didn't recognize, but had to click on it (and it displayed in Preview) to delete it, so did I "open" it, or not?

I apologize for question, but every once in awhile, I realize I don't know something basic and simple and important!

[kaos]

Hi Kay,
Probably the best thing to do so you don't have to open to delete them, is go to View>Layout in OE and uncheck the "Preview Pane" towards the bottom. HTH.

[kayofcircles]

But (whine!), I like it this way, kaos . And don't want to change it unless I am in danger of opening the wrong thing.

[buck52]

Kayofcircles

I wondered the same thing
Now I have OE set with no preview pane as Kaos says.
When I go to my inbox if I'm unsure about an email I right click and select properties then details then message source.

I believe this allows you to see the whole message without ever accually opening it

buck

------------------
just hav'n fun

[sea69]

Originally posted by buck52:
Kayofcircles

I wondered the same thing
Now I have OE set with no preview pane as Kaos says.
When I go to my inbox if I'm unsure about an email I right click and select properties then details then message source.

I believe this allows you to see the whole message without ever accually opening it

buck



yes, this is what I do (above)

and I do not trust "preview"

as mentioned, if you simply right click the email, and then go to properties, you can see the entire message (no pix)

and prior to looking at any pix you can virus scan the attachments.



------------------
sea1_69@hotmail.com

homepage (http://www.seanweb1.homestead.com/3.html)


;)~

[kayofcircles]

When I right click on a message and get Properties, I don't see the actual message, just details on where it came from. Might be because am using the Preview pane?

Another thing that makes me want to "stay" with the Preview pane is that I keep a PC draft with links to threads that I am following. The links do NOT work in the "open" draft..only in the preview pane. I have the draft open every day adding and deleting links. Without the preview pane, I would have to copy/paste the link to go the next topic of interest.

[sea69]

sorry, I wasn't exact.

try this:

right click any email>> click Properties>> Details TAB>> Message source.

this will show you the exact full message as well as who actually sent it.

http://www.PCGuide.com/ubb/wink.gif



------------------
sea1_69@hotmail.com

homepage (http://www.seanweb1.homestead.com/3.html)


;)~

[kaos]

Kay,
To view the message when you right click it and then click properties, click "Message Source". It works with the Preview Pane showing or hidden. But, if it's showing, it will already be open for you to see in your Preview Pane.

Edit: Sorry sea, I must have been a lil slow, you weren't there when I started. http://www.PCGuide.com/ubb/smile.gif



[This message has been edited by kaos (edited 08-11-2001).]

[kayofcircles]

Wow..never clicked on Message Source before..and you guys are right, message is displayed there with a lot of really interesting Greek (to me) stuff. http://www.PCGuide.com/ubb/smile.gif

So you think that by using Preview, I am taking a chance of "opening" a bad thing? Because, sigh, I guess I could figure some kind of workaround on the link problem. Thanks too for being patient with question.

[Vic 970]

I did an e-mail course a few months ago, using Outlook, I was told by the instructor NOT to use the preview pane, but that it was ok to double click & open e-mails that way. whether that has something to do with my firms antivirus I don't know. I thought that viruses were contained in attachments.

------------------
for every question there's an answer. Then a load more questions.

Regards..,
Vic.

[sea69]

virus, or vb script can be executed in an html link or other ways also from within an email.



------------------
sea1_69@hotmail.com

homepage (http://www.seanweb1.homestead.com/3.html)


;)~

[Pianorak]

sea69 - You got me worried - could you please elaborate on <<or other ways also from within an email>>. What other ways?

[sea69]

For the sake of historic justice, I have to mention that first publication, extensively covering the dangers of HTML-capable email clients, was in my Internet column, Evening Internet, on December 29, 1997.
The column runs in Russian, therefore it wasn't noticed abroad, but locally it received an extensive coverage, including articles in MK daily (circulation ~1M copies), Izvestia, and Moscow computer press. A local MS representative gave an official response to those issues (dated Jan 13, 1998), which was also in Russian.

But the historical aspects are not essential here. This story needs to be publicised widely, since it requires amendment to all HTML-capable email clients on the market, especially Netscape Messenger, Microsoft Outlook, and Eudora Pro 4.0.

Now to specifics:

The dangers of mandatory HTML tag support in email clients fall into two categories:


Those you can avoid by turning some browser features off
Those you can not avoid, without giving up your email client completely
All exploits of JavaScript (infinite window creation, calls to remote sites, etc) can be disabled by simply turning JavaScript off in your browser. An MS representative in his response pointed to this opportunity citing it as a universal remedy.

But email exploits, based on HTML commands, such as IMG and META Refresh can not be disabled in any browser known to humanity.

The IMG tag is good for:


Overloading targeted networks and local computers with traffic and data. You include something like <IMG SRC="http://www.nasa.gov/3Mbyte-heavy image.jpg" WIDTH=1 HEIGHT=1>, ten times in a row, mail this letter to all clients of one specific provider -- and his bandwidth is noticeably reduced

Spamming people with banner ads. Opening an email causes an ad to load, generating a "view," for which a banner exchange network (or the advertiser) is supposed to pay cash.
The redirect technique is also good both for hacking and spamming purposes:


You can redirect any Netscape or Explorer user to a site, where any sort of ping attack is exploited (LAND, IP Fragmentation, OOB, NUKE, you name it). Browser security is highly irrelevant in this case, since the attacker only needs to obtain an IP of its target via REMOTE_ADDR variable, to send the deadly data.

Instead of spamming people with invitations to visit a specific page, you can send out a ton of REFRESH invitations, that can not be ignored and refused, once opened.
Special points to take into consideration:


If a message contains harmful HTML code, you can not even delete it. To delete you have to select it, and once you select, the commands within this message are processed for execution once again.

The difference between email and WWW sites renders the entire Microsoft "trusted/untrusted address" ideology futile. When you direct your browser to www.microsoft.com, (http://www.microsoft.com,) you may or may not trust this site. But receiving a message with admin@microsoft.com in its header, you cannot judge its authenticity before opening it.

Microsoft knows all about this threat, and has known since at least spring 1996. There is one simple experiment that proves their full awareness of this effect:

open MS Outlook Express
open Inbox, open the last message
press Reset
The next time you start Windows 95/98/NT and open this same message in MS Outlook Express, a warning is displayed in red letters. This warning says that the system crashed when this message was last opened. Therefore the message will not be displayed, just in case it was the effective reason of the crash.

Admitting to such a possibility, it's strange that Microsoft avoids really warning people, or providing means to disable automatic HTML support in its Outlook Express mail client.


There is one way to confront all threats associated with the above exploits. Just close the message preview panel, and use View Message Source for reading whatever you've selected. This is an alternative -- a rather clumsy, but inevitable one -- to the "disable HTML support in messages" command, which is absent in all HTML-capable clients these days.
The first JavaScript exploit of HTML mail capabilities was developed by Andrew Maltsev in December 1997. Dmitry Touretsky, publisher of SOFT Weekly Digest in Russian (a bulletin like TBTF, but leaning heavily on particular 32-bit Windoze programs) has published a special report on HTML and other email threats, late in January this year. Says Dmitry in a personal letter to yours truly:


Wherever I happened to work as an Intranet security advisor, I kept warning managers from installing HTML-capable email software, since it was first introduced. IMHO, those risks are quite obvious to anyone familiar with HTML.
I hope this clarification is useful, regarding the extent of the email HTML treat and the available means of its avoidance.

With best regards - Dr. Anton Nossik <anton at cityline dot ru> http://www.cityline.ru/vi/current.htm

and,

The latest worms have been mostly masquerading as picture files, but are really Visual Basic Script (VBS) files. They do this quite simply by exploiting a vulnerability within Microsoft Windows, whereby file extensions of known file types are not normally shown to the user. The virus creator gives the virus file two sequential extensions, the first one being an innocuous file type and the second being the real file type of the file. Windows hides the last extension and shows the file with what now seems to be a single extension. Users see the displayed dummy extension and thinking that it is a safe file type, are fooled into opening what is really a VBS style worm. A well known example appears as an attachment called AnnaKournikova.jpg (a picture file). It is really a file called AnnaKournikova.jpg.vbs but the "vbs" is hidden because it is a known file type. Damage from these types of outbreaks is easily avoided with a little custom work on the users’ PC. All it really takes is modifying a few settings on the computer so that known file types are always shown and the chances of an outbreak are fairly slim.

The Worm Generator.

A worm is a self-contained program, or set of programs, that is able to spread functional copies of itself to other computer systems (usually via a network). Recently, the creator of the worm generating program (VBSWG 2.0), [K]alamar, took his enhanced virus tool off his web site with the fear that he was being hunted by the authorities, and that they may try to jail him for writing the software.

hehe.. now who's 'paranoid'??

personally, I use and prefer html email, and have not had any problems, many companies do not allow it (many firewalls either)

http://www.PCGuide.com/ubb/wink.gif

------------------
sea1_69@hotmail.com

homepage (http://www.seanweb1.homestead.com/3.html)




[This message has been edited by sea69 (edited 08-11-2001).]

[buck52]

Here's a site I was pointed to for more info and testing of this sort of thing http://www.finjan.com/mcrc/test.cfm

buck

------------------
just hav'n fun

[ranchdog]

KAY... Something that might help ya out is to adjust the amount of time allowed to read a given e-mail before OE opens the envelope for you. This way you can see and read what is in the envelope and delete it if you are in doubt. Go to OE / tools / options / read and adjust the time factor in seconds to suite yourself. I have mine set at 20 seconds.
A script (worm) virus can be a different deal. It can be hidden in an e-mail address. The 'ol KAK virus. When a particular e-mail is highlighted the boogey-man is all ready loose. The Bells and Whistles of the anti-virus program go off like crazy, then you have to run th AV program and isolate it. It's best to dis-able script hosting in add/remove programs for help on this one. It's in add/remove...setup.
This is OT but are you familiar with CR A-085? Just curious.
Luck. http://www.PCGuide.com/ubb/wink.gif

------------------
......Indecision may or may not be my problem......
...... Kickin' A Rock....

[Vic 970]

So how safe are we?

I'm using Outlook (not outlook Express) & when I right clip I dont get Properties (nor can I find it elsewhere) but if I click Options, I get some details but not the message.

Also what of antivirus? I'm in the process of configuring mine, & one of the options,(under 'tools' then 'e-mail scan properties') is 'check inbox' or 'check highlighted message' but am not sure whether this is automatic or not, the next option is 'virus scan' which appears to be a manual option.

------------------
for every question there's an answer. Then a load more questions.

Regards..,
Vic.

[kayofcircles]

mjc: The "mark message as read after displaying for" part has something to do with opening? Thought that was just for the little blue numbers that show just right of Inbox, or Drafts, or whatever. And no, have no idea what CR A-085 is. Always ready to learn though.

I do have to admit that I am a bit stubborn on this particularly kind of thing. I still have the "thrill" of surfing and email and coming here..all those cool things about Internet access. I do want to be careful and cautious, but I don't want to get so fearful that I can no longer experience the joy in it because of some twitfaces out there...you know? Just posted the question on how to turn off Internet Securities' popups for my uncle over in the port 80 thread..but he is afraid to surf at all now. I seriously doubt that there are a lot of hackers trying to get into a puter owned by an elderly gentleman in a rest home...but he has gotten several worms so far, so what do I know?

Vic: Agree with your sig big time!

[ranchdog]

My O/T comment was CR = County Road. Have some friends live there. An Anti-Virus program is a person's only salvation anymore. E-Mail and surfing the net for downloads are huge reasons why most people have a PC. Wish I owned a dynamite A-V company about now. Peace.

------------------
......Indecision may or may not be my problem......
...... Kickin' A Rock....

[Vic 970]

Set up my A/V yesterday, it's supposed to check downloads, e-mails & attachments (amongst other things) but I've just had a visit from HaHaHa, snow white, which has been going around for some while now, & I updated my A/V 2 days ago.

I deleted it (snow white) without opening & did a virus check which came up with nothing.

the A/V is set to delete & report, but I haven't recieved a report.

this is of some concern: is the A/V no good, or is snow white not what it was reported to be?

maybe we can only do what we feel is adequate, back up our data, take lots of vitamin C & deal with the inevatable when it happens, or maybe we've ignored it for too long, & this topic may be our best bet of getting some useful advice on prevention, apart from the obvious, ie. switch off the pc & leave it off.

------------------
for every question there's an answer. Then a load more questions.

Regards..,
Vic.

[sea69]

hehe.. it would have detected it- after you opened it.

http://www.PCGuide.com/ubb/wink.gif



------------------
sea1_69@hotmail.com

homepage (http://www.seanweb1.homestead.com/3.html)


;)~

[iisbob]

As to all the above mentioned fixes, workarounds, etc...that's why i chose norton antivirus; as it sets up a proxy to scan your email & attachments before they are actually downloaded physically onto your system. That's how i've been keeping uninfected becuase norton catches the virii/worm before i ever see it.

Every time i've ever recieved an attachement ( one that norton passed ) , using preview, i set up outlook to ask me if i want to open it now or save to disk. That's the best way to deal with attachments, even if you don't have an anti-virus program; save then to disk to scan later with your antivirus program ( or you can safely right click and choose properties )-this will not execute a worm or virii.

You can never be to paraniod about e-mail nowadays, as they create newer more convienent code for using the web-it can also negatively impact the security of the web. kinda like a catch22; the easier you make it for the average user-the easier you make it for the expert to harm that user.
http://www.PCGuide.com/ubb/frown.gif

My suggestion to you Kay is to get a good antivirus ( norton i recommend ) that sets up a proxy for email so that you can rest at least a little easier without inconviencing yourself unduly.It used to be a steadfast rule that you never opened an attachment; but that is no longer practical in todays mom&grandma baby picture sending enviroment.

------------------
iisbob
"Soap and education are not as sudden as a massacre, but they are more deadly in the long run."

"Imagination is more important than knowledge. Knowledge is limited. Imagination encircles the world." --Albert Einstein (1879-1955)

[Gallaeglagh]

Originally posted by ranchdog:
KAY... Something that might help ya out is to adjust the amount of time allowed to read a given e-mail before OE opens the envelope for you. This way you can see and read what is in the envelope and delete it if you are in doubt. Go to OE / tools / options / read and adjust the time factor in seconds to suite yourself. I have mine set at 20 seconds.
A script (worm) virus can be a different deal. It can be hidden in an e-mail address. The 'ol KAK virus. When a particular e-mail is highlighted the boogey-man is all ready loose. The Bells and Whistles of the anti-virus program go off like crazy, then you have to run th AV program and isolate it. It's best to dis-able script hosting in add/remove programs for help on this one. It's in add/remove...setup.
This is OT but are you familiar with CR A-085? Just curious.
Luck. http://www.PCGuide.com/ubb/wink.gif



Is there any downside to removing scipt hosting?



------------------
Sweet Intoxication