New Entourage 2004 v11.5.1 security vulnerability

[GEOPIX]

Version: 2004
Operating System: Mac OS X 10.4 (Tiger)
Processor: Intel
Email Client: pop

Office 2004 v11.4.0, v11.4.1 v11.5.0, v11.5.1
Mac OS X v10.4.11.

During the past two weeks i've updated Office incrementally -- from version 11.4.0 to 11.5.1. While using Entourage during this time period, I've noticed something new and odd happening. Contact names and e-mail addresses from certain spammers automatically are being placed in my Entourage Address Book! I first noticed this after porting my Contacts to a new iPhone sometime around July 13, only because I was closely scrutinizing the Entourage Contacts that were being synced to the iPhone Contacts. These mysterious, unauthorized Contact additions may have been in my Entourage Address Book before that date, but I did not notice them until that first iPhone sync.

I have Entourage setup safely -- I DO NOT open e-mail in the optional Preview window. Instead, I analyze all incoming pieces using the List view and trash obvious spam BEFORE opening my e-mail. I use Entourage Mail Filtering and Rules to delete incoming spam. During this same time frame, my Entourage Rules sorting and trashing spam also disappeared, either due to one of the updates or perhaps something nefarious.

I don't recall this mysterious Contacts behavior ever happening before. Many, but not all of the unauthorized Contact additions are from Google g-mail. I'm probably getting eight or ten unauthorized Contacts entries every time I download e-mail (perhaps four-to-six times per day). I keep deleting these spam Contacts from the Address Book, but the same new ones -- and others -- keep re-appearing! Then, they are being moved onto my new iPhone during Microsoft Sync Services or Apple MobileMe syncs.

Correct me if I'm wrong, but I believe this means that my computers are vulnerable to follow-up, e-mail attacks from these spammers.

I wonder if anyone else has noticed this happening?

 

[Adam Bailey]

During the past two weeks i've updated Office incrementally -- from
version 11.4.0 to 11.5.1. While using Entourage during this time period,
I've noticed something new and odd happening. Contact names and e-mail
addresses from certain spammers automatically are being placed in my
Entourage Address Book! I first noticed this after porting my Contacts to
a new iPhone sometime around July 13, only because I was closely
scrutinizing the Entourage Contacts that were being synced to the iPhone
Contacts. These mysterious, unauthorized Contact additions may have been
in my Entourage Address Book before that date, but I did not notice them
until that first iPhone sync.

See if you have a Rule (Tools > Rules) that adds senders from incoming
messages to your address Book.

 

[Guest]

Adam:

Well, there was such a new Rule to Add Senders of Incoming Messages to the Address Book, though I'm not sure how it was created. I'll now have to test Entourage to see deleting this Rule solved my problem. It will give me something to do tomorrow.

As I wrote, "...During this same time frame, my Entourage Rules sorting and trashing spam also disappeared, either due to one of the updates or perhaps something nefarious..."

It seems most likely that I was attempting to set up a new Rule, got part way through a first one, stopped or was interrupted, and then forgot to go back and finish. These sorts of things usually turn out to be "Operator Error."

Thanks for the thought Adam. I'll post a follow-up later to see if this solution worked.