How can I forward hyperlinks w/out visiting linked site (Outlook 2003)?

[Steve Hull]

Like everybody else, I receive my share of spam, including the phishy
variety. When I get a spoofed email, I like to forward it on to
(e-mail address removed), spamcop, and any admin of a site victimized by a phishing
exploit. For any of these sites to track down the source, they need
the full, unmodified email, just as I received it.

If I receive an email from an untrusted source, Outlook does the right
thing by not displaying any hyperlinked info in the preview pane.
However, if I try to forward an email with hyperlinks, Outlook wants
to go to the spammer's website, download whatever treat the spammer
has waiting for me, and insert it in my forwarded message. (Not to
mention that the spammer could use the fact that I visited his website
to validate my email address.)

I really, really, don't like this behavior. If there's a way to
configure Outlook to forward exact copies of an email (and leave the
hyperlinks alone), I'd sure like to know about it.

Can anyone help me figure this out?

Thanks,

- Steve

 

[Milly Staples [MVP - Outlook]]

No, Outlook will always need to go out to retrieve the missing infomration
from blocked mails. You must have a lot of time on your hands to send all
the spoofed email to abuse organizations. Most of this stuff is so faked
(headers, IPs, mailing addresses) that the only people who are affected are
those who have had their address used by the spammer.

--
Milly Staples [MVP - Outlook]

Post all replies to the group to keep the discussion intact. Due to
the (insert latest virus name here) virus, all mail sent to my personal
account will be deleted without reading.


After scratching one's head,
Steve Hull <[email protected]> asked this group:
| Like everybody else, I receive my share of spam, including the phishy
| variety. When I get a spoofed email, I like to forward it on to
| (e-mail address removed), spamcop, and any admin of a site victimized by a phishing
| exploit. For any of these sites to track down the source, they need
| the full, unmodified email, just as I received it.
|
| If I receive an email from an untrusted source, Outlook does the right
| thing by not displaying any hyperlinked info in the preview pane.
| However, if I try to forward an email with hyperlinks, Outlook wants
| to go to the spammer's website, download whatever treat the spammer
| has waiting for me, and insert it in my forwarded message. (Not to
| mention that the spammer could use the fact that I visited his website
| to validate my email address.)
|
| I really, really, don't like this behavior. If there's a way to
| configure Outlook to forward exact copies of an email (and leave the
| hyperlinks alone), I'd sure like to know about it.
|
| Can anyone help me figure this out?
|
| Thanks,
|
| - Steve

 

[Steve Hull]

Yeah, since my programming job got offshored to India, I have nothing
better to do than play whack-a-spammer. Last year, my domain name was
used to spoof return addresses used in a LOT of spam (look up "Joe
Job"), so I had to do a lot of explaining to my ISP why they should
restore my service. Ever since then, I do tend to be more proactive
in the fight against spam. Most people are happy to have their email
automatically put in a spam folder and they just delete it. They
never think about the technology behind the process that determines
whether or not an email is spam. Ever hear of a Black Hole List?
RBL? Spamhaus? Most of the spam filters contact these sources to
validate (or invalidate) an email based on its source address. How do
these sources build their databases of spam sources? When people
report spam to them. (To be fair, they probably get more input from
honeypots.) Cloudmark, Bright Mail, and many other HUGE anti-spam
software products depend on their user base reporting spam back to a
central site where adaptive filters get created as soon as the spam is
reported.

All that has nothing to do with the fact that there is no good reason
why Outlook HAS to visit an URL before forwarding the email on. I
have pointed out a legitimate security concern, and asked how to
address the issue. You have responded by ridiculing my reasons for
wanting the activity blocked rather than focusing on the problem.
Perhaps that kind of attitude is why Outlook has had so many security
issues in the first place.

-Steve Hull

No, Outlook will always need to go out to retrieve the missing infomration
from blocked mails. You must have a lot of time on your hands to send all
the spoofed email to abuse organizations. Most of this stuff is so faked
(headers, IPs, mailing addresses) that the only people who are affected are
those who have had their address used by the spammer.

--?
Milly Staples [MVP - Outlook]

 

[Milly Staples [MVP - Outlook]]

Sigh, where to begin.

RBLs are useless and exist mostly to charge legitimate email users a fee to
reinstate their mail address and remove it from the RBL. Check their use
policies.

Outlook blocking access and requiring YOU to specifically authorize it to go
to the web page is NOT a security issue - it is a response to security that
most people welcome. You tell me, how is Outlook supposed to magically pull
the information out of its hat WITHOUT going to the web page? If it does
not have to go there, then then information has been downloaded - how is
that secure?

Third, in no manner did I ridicule you - I just pointed out that reporting
the addresses is mostly a waste of time as there IS no such domain as
@adifajeitraewrh.com or whatever combination of letters you receive. They
are spoofed, as are the headers and the IPs.

Do as you wish with your time and good luck finding new employment. As for
how you spend your time, it is of no matter to me. I just know how I choose
to spend my time, chasing my kitties and avoiding the inevitable ankle sneak
attacks. Oh, and answering posts to the news groups, hopefully to a more
grateful and less sensitive audience than this one.


--
Milly Staples [MVP - Outlook]

Post all replies to the group to keep the discussion intact. Due to
the (insert latest virus name here) virus, all mail sent to my personal
account will be deleted without reading.

After searching google.groups.com and finding no answer, Steve Hull asked:

| Yeah, since my programming job got offshored to India, I have nothing
| better to do than play whack-a-spammer. Last year, my domain name was
| used to spoof return addresses used in a LOT of spam (look up "Joe
| Job"), so I had to do a lot of explaining to my ISP why they should
| restore my service. Ever since then, I do tend to be more proactive
| in the fight against spam. Most people are happy to have their email
| automatically put in a spam folder and they just delete it. They
| never think about the technology behind the process that determines
| whether or not an email is spam. Ever hear of a Black Hole List?
| RBL? Spamhaus? Most of the spam filters contact these sources to
| validate (or invalidate) an email based on its source address. How do
| these sources build their databases of spam sources? When people
| report spam to them. (To be fair, they probably get more input from
| honeypots.) Cloudmark, Bright Mail, and many other HUGE anti-spam
| software products depend on their user base reporting spam back to a
| central site where adaptive filters get created as soon as the spam is
| reported.
|
| All that has nothing to do with the fact that there is no good reason
| why Outlook HAS to visit an URL before forwarding the email on. I
| have pointed out a legitimate security concern, and asked how to
| address the issue. You have responded by ridiculing my reasons for
| wanting the activity blocked rather than focusing on the problem.
| Perhaps that kind of attitude is why Outlook has had so many security
| issues in the first place.
|
| -Steve Hull
|
|
|
| On Sat, 28 Aug 2004 17:25:19 -0700, "Milly Staples [MVP - Outlook]"
|
|| No, Outlook will always need to go out to retrieve the missing
|| infomration from blocked mails. You must have a lot of time on your
|| hands to send all the spoofed email to abuse organizations. Most of
|| this stuff is so faked (headers, IPs, mailing addresses) that the
|| only people who are affected are those who have had their address
|| used by the spammer.
||
|| --?
|| Milly Staples [MVP - Outlook]
|
||
|| After scratching one's head,
|| Steve Hull <[email protected]> asked this group:
||| Like everybody else, I receive my share of spam, including the
||| phishy variety. When I get a spoofed email, I like to forward it
||| on to (e-mail address removed), spamcop, and any admin of a site victimized by a
||| phishing exploit. For any of these sites to track down the source,
||| they need
||| the full, unmodified email, just as I received it.
|||
||| If I receive an email from an untrusted source, Outlook does the
||| right thing by not displaying any hyperlinked info in the preview
||| pane. However, if I try to forward an email with hyperlinks,
||| Outlook wants
||| to go to the spammer's website, download whatever treat the spammer
||| has waiting for me, and insert it in my forwarded message. (Not to
||| mention that the spammer could use the fact that I visited his
||| website to validate my email address.)
|||
||| I really, really, don't like this behavior. If there's a way to
||| configure Outlook to forward exact copies of an email (and leave the
||| hyperlinks alone), I'd sure like to know about it.
|||
||| Can anyone help me figure this out?
|||
||| Thanks,
|||
||| - Steve

 

[Brian Tillman]

RBLs are useless and exist mostly to charge legitimate email users a
fee to reinstate their mail address and remove it from the RBL.
Check their use policies.

Not true, sorry. RBLs prove very useful and most of the ones of which I'm
aware charge nothing to remove addresses.

Outlook blocking access and requiring YOU to specifically authorize
it to go to the web page is NOT a security issue - it is a response
to security that most people welcome. You tell me, how is Outlook
supposed to magically pull the information out of its hat WITHOUT
going to the web page? If it does not have to go there, then then
information has been downloaded - how is that secure?

It can merely forward the exact same message that was sent. The message
contains a URL to display. Outlook doesn't have to include that display in
the forward, merely the original URL.

Third, in no manner did I ridicule you - I just pointed out that
reporting the addresses is mostly a waste of time as there IS no such
domain as @adifajeitraewrh.com or whatever combination of letters you
receive. They are spoofed, as are the headers and the IPs.

At least one header will be legitimate and will be the relaying IP. Often
those are IPs in ranges that should never allow relaying, so contacting the
relaying ISP is never a waste of time.

 

[Steve Hull]

Sigh, where to begin.

RBLs are useless and exist mostly to charge legitimate email users a fee to
reinstate their mail address and remove it from the RBL. Check their use
policies.

Oh, dear, let's begin with the basics, and walk you through this in
itty-bitty pieces:

If Blackhole Lists were useless, then nobody would use them, and
certainly nobody would pay them. In that case, they would just fade
away. I actually went and checked spamhaus.org and spamcop.net's
policies- did you, or did you just shoot from the hip? Neither
organization charges a fee to get removed from their lists. What is
their business model? Spamhaus is free if you want to link your mail
server to it unless you have a high-volume (like an ISP or a large
organization). Spamcop charges end-users a fee to have their email
filtered before it gets to their in-box. If you're downloading spam
over a cell-phone link to your pda/laptop, you really don't care if
Outlook puts it in your spam folder- you've already paid (in terms of
air time) to download the sucker.

Now, the fact that spamhaus is free to small organizations coupled
with the fact that they've been in business for several years suggests
that there are enough large corporations & ISPs paying their fees that
they can keep their doors open. Your opinion of the value of an RBL,
is not shared by these companies customers.

Outlook blocking access and requiring YOU to specifically authorize it to go
to the web page is NOT a security issue - it is a response to security that
most people welcome. You tell me, how is Outlook supposed to magically pull
the information out of its hat WITHOUT going to the web page? If it does
not have to go there, then then information has been downloaded - how is
that secure?

Whoa, Nelly! I never said anything of the kind. I started this
conversation off by saying Outlook did the right thing by blocking
access to embedded links when viewing mail from untrusted sources.
What Outlook does not do, and what I asked about, was why Outlook does
not block access to embedded links when forwarding an email from an
untrusted source. You then avoided answering my question by telling
me you thought I was wasting my time forwarding emails to report spam.

Third, in no manner did I ridicule you - I just pointed out that reporting
the addresses is mostly a waste of time as there IS no such domain as
@adifajeitraewrh.com or whatever combination of letters you receive. They
are spoofed, as are the headers and the IPs.

You may be an Outlook guru, but apparently you don't know diddly about
reading and tracing email headers. Of course, that's not entirely
your fault- Outlook intentionally hides the header info. And, it IS
time-consuming to check out each address in a long string of
addresses. Even though 99.99% of the spam has forged return
addresses, there really is a valid email address in all those headers
that identifies the site where the spam was introduced into the
system. Most of the time, that site is an open relay. Guess what:
there are even open relay lists that email servers can check to see if
an email is coming from a known relay point. And, for the most part,
it doesn't cost any money to use these lists, either.

You really should sign up for a free account at spamcop. Then, send
in one of your spam emails. Spamcop does a pretty amazing job of
decoding the email headers, and can automatically generate a complaint
to the proper party. Spamcop keeps track of how much spam is coming
from a particular site. ISPs watch these counters, and many of them
use the counters when they decide to block a host. I know you don't
believe in RBLs, but the spammers certainly do: Optinrealbig recently
sued Spamcop, claiming their right to free speech had been violated.
If Spamcop wasn't effective in stopping spam, Optinrealbig wouldn't
have bothered suing them.

Do as you wish with your time and good luck finding new employment. As for
how you spend your time, it is of no matter to me. I just know how I choose
to spend my time, chasing my kitties and avoiding the inevitable ankle sneak
attacks. Oh, and answering posts to the news groups, hopefully to a more
grateful and less sensitive audience than this one.

Leaving aside your opinion of whether reporting spam is a waste of
time, or my opinon of cats, there is a serious issue here. There are
irrefutable facts: web bugs exist, they are implanted in a high
percentage of spam, they often contain code to verify your email
address, and Microsoft thought the problem was significant enough that
they put in protection against inadvertently activating them when
viewing your incoming email. I suggest to you that what they did was
admirable, but they didn't fix the entire problem. They also need to
protect against inadvertently activating web bugs in your outgoing
mail.

Steve Hull

--?
Milly Staples [MVP - Outlook]

Post all replies to the group to keep the discussion intact. Due to
the (insert latest virus name here) virus, all mail sent to my personal
account will be deleted without reading.

After searching google.groups.com and finding no answer, Steve Hull asked:

| Yeah, since my programming job got offshored to India, I have nothing
| better to do than play whack-a-spammer. Last year, my domain name was
| used to spoof return addresses used in a LOT of spam (look up "Joe
| Job"), so I had to do a lot of explaining to my ISP why they should
| restore my service. Ever since then, I do tend to be more proactive
| in the fight against spam. Most people are happy to have their email
| automatically put in a spam folder and they just delete it. They
| never think about the technology behind the process that determines
| whether or not an email is spam. Ever hear of a Black Hole List?
| RBL? Spamhaus? Most of the spam filters contact these sources to
| validate (or invalidate) an email based on its source address. How do
| these sources build their databases of spam sources? When people
| report spam to them. (To be fair, they probably get more input from
| honeypots.) Cloudmark, Bright Mail, and many other HUGE anti-spam
| software products depend on their user base reporting spam back to a
| central site where adaptive filters get created as soon as the spam is
| reported.
|
| All that has nothing to do with the fact that there is no good reason
| why Outlook HAS to visit an URL before forwarding the email on. I
| have pointed out a legitimate security concern, and asked how to
| address the issue. You have responded by ridiculing my reasons for
| wanting the activity blocked rather than focusing on the problem.
| Perhaps that kind of attitude is why Outlook has had so many security
| issues in the first place.
|
| -Steve Hull
|
|
|
| On Sat, 28 Aug 2004 17:25:19 -0700, "Milly Staples [MVP - Outlook]"
|
|| No, Outlook will always need to go out to retrieve the missing
|| infomration from blocked mails. You must have a lot of time on your
|| hands to send all the spoofed email to abuse organizations. Most of
|| this stuff is so faked (headers, IPs, mailing addresses) that the
|| only people who are affected are those who have had their address
|| used by the spammer.
||
|| --?
|| Milly Staples [MVP - Outlook]
|
||
|| After scratching one's head,
|| Steve Hull <[email protected]> asked this group:
||| Like everybody else, I receive my share of spam, including the
||| phishy variety. When I get a spoofed email, I like to forward it
||| on to (e-mail address removed), spamcop, and any admin of a site victimized by a
||| phishing exploit. For any of these sites to track down the source,
||| they need
||| the full, unmodified email, just as I received it.
|||
||| If I receive an email from an untrusted source, Outlook does the
||| right thing by not displaying any hyperlinked info in the preview
||| pane. However, if I try to forward an email with hyperlinks,
||| Outlook wants
||| to go to the spammer's website, download whatever treat the spammer
||| has waiting for me, and insert it in my forwarded message. (Not to
||| mention that the spammer could use the fact that I visited his
||| website to validate my email address.)
|||
||| I really, really, don't like this behavior. If there's a way to
||| configure Outlook to forward exact copies of an email (and leave the
||| hyperlinks alone), I'd sure like to know about it.
|||
||| Can anyone help me figure this out?
|||
||| Thanks,
|||
||| - Steve