Home » Computer » Network » Archive by category "Mail" (Page 3)

結合 Malware 與 Social Engineering 的詐騙

在「Malware scam appears to use GPS data to catch speeding Pennsylvania drivers」這邊看到新的詐騙方式。

手機的 malware app (藏有惡意程式的 app) 會要求 GPS 資料 (現在智慧型手機上 app 的常態),而當 malware app 偵測到你超速時,詐騙集團就會發出假的超速罰單,像是這樣:

From: Speeding Citation
To: (Accurate Email Removed)
Date: 03/11/2016 03:08 PM
Subject: [External] Notification of excess speed
First Name: (Accurate Name removed)
Last Name: (Accurate Name removed)
Notification of excess speed
Route: (Accurate Local Township Road –removed)
Date: 8 March 2016
Time: 7:55 am
Speed Limit: 40
Detected Speed: 52
The Infraction Statement contains an image of your license plate and the citation which must be paid in 5 working days.

文章提用的標語「ACCURATE SPEEDING DATA, FAKE EMAIL」好讚... XD

StartSSL 的認證出包

這幾天還蠻歡樂的新聞,StartSSL 的認證過程出包,可以用任何 email 收認證信:「StartSSL Domain validation (Vulnerability discovered).」。直接看這張圖就好:

這樣傳不是問題 (因為你還是可以在 server 端再確認一次),而是改了會動 (樂):

這家公司最近傳出好多負面新聞... (啊,我把他們家的 root certificate 標成 untrusted 一陣子了 XD)

MediaWiki 的 EmailDiff 套件

先前 MediaWiki 所提供的「變更通知」都只有在信件裡「通知」,而沒有在信件裡列出「改變的內容」,這使得讀信的人要再點進去看... (於是就懶的點了)

而前陣子看到有人寫了 extension 來輸出 diff,解決了這個問題:「MediaWiki extension EmailDiff: notification emails improved」。

信裡變成有這樣的內容:

Version differences:
@@ -846,5 +887,3 @@
 In cattle, temperament can affect production traits such as carcass and meat 
 quality or milk yield as well as affecting the animal's overall health and 
-reproduction. Cattle temperament is defined as "the consistent behavioral and physiological 
-difference observed between individuals in response to a stressor or environmental 
+reproduction. If you succeed in tipping a cow only partway, such that only one 
+of its feet is still on the ground, you have created lean beef. Such a feat is 
+well done. Naturally, being outside, the cow is unstable. When it falls over, 
+it becomes ground beef. Cattle temperament is defined as "the consistent behavioral 
+and physiological difference observed between individuals in response to a stressor or environmental 
 challenge and is used to describe the relatively stable difference in the behavioral 
 predisposition of an animal, which can be related to psychobiological mechanisms.

這樣可讀性高非常多,來找人裝看看好了...

追蹤開信的能力

追蹤開信的能力是廣告信經常會用到的能力,為了要看「成效」而要追蹤開信率之類的數字。

在「Email Privacy Tester」這邊看到有趣的工具,介紹了「Email Privacy Tester」這個網站可以拿來測試各種 mail client 上可被追蹤的功能。

依照作者測試,Gmail 完美的擋下目前所有追蹤技巧:

Apple Mail 還很慘,有一堆方式可以被追蹤開信:

不知道其他家 (像是 Yahoo) 的情況...

Gmail 將會提示沒有支援 STARTTLS 的信箱

Gmail 界面將會提示不支援 STARTTLS 的信箱:「Making email safer for you」。

先確認 msa.hinet.net 的 MX record:

;; ANSWER SECTION:
msa.hinet.net.          86174   IN      MX      0 msa-smtp-mx1.hinet.net.
msa.hinet.net.          86174   IN      MX      0 msa-smtp-mx2.hinet.net.

以及不支援 STARTTLS (在 EHLO 後不會出現 STARTTLS 選項):

$ t msa-smtp-mx1.hinet.net 25
Trying 168.95.6.53...
Connected to msa-smtp-mx1.hinet.net.
Escape character is '^]'.
220 msa.hinet.net ESMTP Sendmail 8.14.2/8.14.2; Thu, 11 Feb 2016 04:52:16 +0800 (CST)
EHLO localhost
250-msa.hinet.net Hello 114-32-152-63.HINET-IP.hinet.net [114.32.152.63], pleased to meet you
250-ENHANCEDSTATUSCODES
250-PIPELINING
250-8BITMIME
250-SIZE
250-DSN
250-ETRN
250-DELIVERBY
250 HELP
QUIT
221 2.0.0 msa.hinet.net closing connection
Connection closed by foreign host.

打開 Gmail 在收件人的地方輸入 test@msa.hinet.net 後,就會跳出紅色鎖頭表示不支援 STARTTLS。

Hostname 與 Username 的保留名稱問題

在「Hostnames and usernames to reserve」這邊提到公開服務時的保留名稱問題。

首先是提到 hostname 的部分,被各協定使用到的都散落在各標準裡,另外就是利用前幾天提到的「Mozilla 維護的 Public Suffix List」加減擋 cookie...

比較感興趣的是 email 的部分的標準,這邊主要在討論 SSL certificate 的註冊。在「Baseline_Requirements_V1_3_1」的 3.2.2.4. Authorization by Domain Name Registrant 的第四項提到:

Communicating with the Domain’s administrator using an email address created by pre‐pending ‘admin’, ‘administrator’, ‘webmaster’, ‘hostmaster’, or ‘postmaster’ in the local part, followed by the at‐sign (“@”), followed by the Domain Name, which may be formed by pruning zero or more components from the requested FQDN;

也就是指出只能用上面提到的這幾個 mail address 來認證。不過為了安全起見,RFC 2412 定義的也應該擋下來。這兩組標準列出來的 username 都算是合理,沒什麼問題。

最後則是討論 path part,這點倒是有不少地雷可以看看,尤其是最新的 ACME 產生的問題 XDDD

在 Gmail 上做 CSS 效果的問題

TechCrunch 上看到的「Gmail, We Need To Talk」這篇裡提到 Gmail 的問題,尤其是 CSS 這塊:

Each Gmail client renders email differently. You may not be aware of this, but each Gmail client has its own set of frustrating quirks. Having to deal with each version of Gmail makes creating email a nail-biting chore:

  • Gmail.com Webmail. Supports <style> but does not support ids and classes.
  • Gmail Webmail for Business. Does not support <style>.
  • Gmail App for iOS. Randomly increases font sizes by 50 percent (no <style>).
  • Gmail App for Android. Randomly ignores container widths (no <style>).
  • Gmail App for Android (for non Gmail.com addresses). Does not support background images in addition to ignoring container widths (no <style>).
  • Inbox by Gmail for Android. Randomly ignores container widths but does so differently than Gmail App for Android (no <style>).
  • Inbox by Gmail for iOS. Does not support <style> but seems to not suffer from as many quirks as other Gmail mobile apps.

這也就可以理解為什麼有時候手機上看起來怪怪的了 XD

Archives