Hacking the Internet user: E-mail hacking
basics: (i)create a text file using the correct MIME syntax, (ii) use netcat to send the message to an open relay SMTP server, (iii) check the results. Using mpack we can include an attachment . If mail server requires authentication this hack fails, therefore you should use SAM Spade to check server first.
disable Java, JavaScript and ActiveX in Mail, e.g. Thunderbird.
executing code through e-mail: block all emails that have attachments with the extensions .scr,.pif, zip,
Outlook Express: “book worms:” Melissa, ILOVEYOU (see book), Nimda, CodeRed, etc, access OE address book and mail themselves to all entries. More recent versions use as subject and content parts of messages sent or received. Use Microsoft patch. Countermeasure: OE 2003 and above: Tools, Options, Read, Read All messages as Plain Text.
File attachment attacks: scrap files (.shs and .shb), Long file names in attachments should be blocked by anti-virus, or server filtering. Save As in Excel/PowerPoint, and be aware of OE use of the TEMP directory.
