285487 - warn user when clicking on content id links in mail messages

Status: NEW

(MailNews Core :: Attachments, defect)

Description

[David :Bienvenu]

Do we want to warn users when they click on content id links in mail messages,
which launch attachments from the mail message, a la the Netsky worm/virus? The
form of the link is <href=cid:<long hex string>> and then the corresponding
attachment has the corresponding hex string as its content-id. This produces a
link that the user can click on to either execute or save the attachment. We
might want to treat this as suspicious, and inform the user. I'm not sure what
the legitimate use of the cid: form of url would be, other than to avoid having
the user have to click on an attachment. Thoughts? We could add this to the
phishing detection as well

Comment 1

[Hermann Schwab]

(In reply to comment #0)
> Do we want to warn users when they click on content id links in mail messages,
> which launch attachments from the mail message, a la the Netsky worm/virus? The
> form of the link is <href=cid:<long hex string>> and then the corresponding
> attachment has the corresponding hex string as its content-id. This produces a
> link that the user can click on to either execute or save the attachment. We
> might want to treat this as suspicious, and inform the user. I'm not sure what
> the legitimate use of the cid: form of url would be, other than to avoid having
> the user have to click on an attachment. Thoughts? We could add this to the
> phishing detection as well

I´ve also got a phishing mail, where the cid is used to load a gif for a map to
simulate a HTML page. Hovering the map is showing a https://URL of the bank,
clicking would lead to some phishing http:// site.
Can attach or forward, if wanted.
The mail

Comment 2

[Ludovic Hirlimann [:Usul]]

(In reply to comment #1)

> simulate a HTML page. Hovering the map is showing a https://URL of the bank,
> clicking would lead to some phishing http:// site.
> Can attach or forward, if wanted.

If you still have it that would be very nice.