Re: [Full-Disclosure] Is the FBI using email Web bugs?

From: Ben Nelson (lists_at_venom600.org)
Date: 01/08/04

  • Next message: Gregh: "Re: [Full-Disclosure] Is the FBI using email Web bugs?" 
    To: Poof <gui@goddessmoon.org>
Date: Thu, 08 Jan 2004 00:05:45 -0700

    Poof wrote:
    > Actually- the problem with that is that fine... it won't allow any ports
    > except for the needed 25/110/143... Then what's to stop an image from using
    > http://www.spamsite.com:25/110/phonehome.jpg?emailaddress(or whatever)
    >
    > ... Nothing!
    >
    > Nice try though... Best protection is through your email client. O2K3 does
    > it native ^^
    >

    I realize that, my point was that blocking more is better than blocking
    less. Whenever you can block everything and allow only the needed
    traffic, you'll be better off. Removing as many possible 'phone home
    vectors' as possible certainly can't hurt and is good security policy in
    general.

    --Ben

    > ~
    >
    >
    >>-----Original Message-----
    >>From: full-disclosure-admin@lists.netsys.com [mailto:full-disclosure-
    >>admin@lists.netsys.com] On Behalf Of Ben Nelson
    >>Sent: Wednesday, January 07, 2004 7:34 PM
    >>To: Gregh
    >>Cc: full-disclosure@lists.netsys.com
    >>Subject: Re: [Full-Disclosure] Is the FBI using email Web bugs?
    >>
    >>Gregh wrote:
    >>
    >>>wont listen. In Zone Alarm you can tell it to DISALLOW Outlook Express
    >>
    >>(or
    >>
    >>>whatever you like) access to different ports. So, I tell it to disallow
    >>>access to or from port 80 by OE. Thus, a received HTML email with pics
    >>
    >>and
    >>
    >>>such in it just shows blanks, "x" or placeholders, really. Now, while
    >>
    >>saying
    >>
    >>>this, if you decided to use some other port to report back on, sure, you
    >>>would get around this but the majority of spam operators who spam you
    >>
    >>don't
    >>
    >>>require JUST the "click to remove" to be clicked to verify you DO exist
    >>
    >>thus
    >>
    >>>send more spam and sell the address to another spammer. They also have
    >>
    >>port
    >>
    >>>80 and if the email is clicked on by a typical OE setup, just to delete,
    >>
    >>it
    >>
    >>>"phones home". For those described earlier in this paragraph, ZA
    >>
    >>blocking OE
    >>
    >>>in/out on port 80 stops most of the phone home stuff.
    >>
    >>Couldn't you just block all port access from OE *EXCEPT* those that are
    >>needed? (probably 25, 110, 143)
    >>
    >>--Ben
    >>
    >>_______________________________________________
    >>Full-Disclosure - We believe in it.
    >>Charter: http://lists.netsys.com/full-disclosure-charter.html
    >
    >
    > _______________________________________________
    > Full-Disclosure - We believe in it.
    > Charter: http://lists.netsys.com/full-disclosure-charter.html

    _______________________________________________
    Full-Disclosure - We believe in it.
    Charter: http://lists.netsys.com/full-disclosure-charter.html

  • Next message: Gregh: "Re: [Full-Disclosure] Is the FBI using email Web bugs?"

    Relevant Pages

    • Re: Security discussion regarding hubs, firewalls, anti-virus and Vista Security
      ... For the average homeuser it is suggested blocking both TCP and UDP ... user) routers available. ... but you probably meant blocking *outbound* packets ... for mentioned ports. ...
      (microsoft.public.windows.vista.security)
    • Re: Dropping Usenet Access
      ... What makes you think Time Warner is blocking those ports? ... Please send all responses to the relevant news group rather than directly ...
      (comp.sys.mac.system)
    • Re: Blocking IP addresses?
      ... >I use Linksys router. ... Go to Advanced|Filters in the Linksys BEFSR41. ... You can either block all ports for a specified range of IP addresses ... > If you want to do IP blocking, you need a firewall in addition ...
      (comp.security.firewalls)
    • RE: IM & P2P packets
      ... That's the *tricky* part about blocking p2p. ... > to sniff data on your network for certain ports. ... >> with real-world attacks from CORE IMPACT. ...
      (Focus-IDS)
    • Re: Kerio Rule Precedence and Logging
      ... > A rule rather high up in my list blocks incoming traffic to ports 520, ... and the blocking is logged. ... ALL permit rules first, together, after them ...
      (comp.security.firewalls)