503489 - Scam warning disappears in "Plain Text" view mode

Status: RESOLVED INVALID

(Thunderbird :: Message Reader UI, defect)

Description

[Milton Scritsmier]

User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.1) Gecko/20090624 Firefox/3.5 (.NET CLR 3.5.30729)
Build Identifier: 2.0.0.22 (20090605)

For a message Thunderbird thinks is a scam, in the "Original HTML" and "Simple HTML" view modes you see the "Thunderbird thinks this messages might be an email scam." banner, and if you try to click on a link in the email, a warning is generated. But if you then change the view mode to "Plain Text" where some of the links can still be clickable, the scam banner goes away and the warning message when a link is clicked does not show up. Since misdirected links to sites which load malicious code are a primary way scam emails work, a simple changing of the view mode should not affect the scam status of the message. A scam message is a scam message no matter what viewing mode you are using.

Reproducible: Always

Steps to Reproduce:
1. Find a message Thunderbird thinks is a scam
2. View it in original or simple HTML mode to see the scam warning banner.
3. Then switch the view mode to "Plain Text". Many messages with links in them will still have some links which are clickable, but the scam warning banner goes away.
Actual Results:  
Clicking on a scam email in "Plain Text" view mode does not generate the scam banner nor generates a warning when a link is clicked.

Expected Results:  
If Thunderbird thinks a message is a scam, in "Plain Text" viewing mode, the scam banner should be displayed and a warning message generated if a link is clicked. In other words, if Thunderbird thinks a message is a scam, the warnings shouldn't depend on the viewing mode.

Comment 1

[Daniel Veditz [:dveditz]]

Since whether Thunderbird uses plain-text view is not under the control of an attacker, and is not commonly used in any case, having this bug hidden is more of a hindrance to having someone look at it than a protection for users.

qawanted: It's unclear from the description if the plain text view _never_ shows the scam warning, or if the messages the reporter is looking at simply have the scam part hidden in that view but some other message would show the warning.

My guess (as someone who is not a Thunderbird developer!) is that the scam warning came from the fact that the link text said one domain ("www.yourbank.com") and really went to another ("evil.com"). In plain text there is no deception, only "evil.com" is shown. I believe we also warn about suspicious links such as IP addresses, and my guess is that those will still trigger the scam warning in plain-text mode.

Since the phishers might have gotten "www.yourbankservices.com" we're throwing away clues that would help us flag the mail as deceptive.

Of course the Thunderbird heuristics are baby-steps, what we really need to do is hook it up to the "SafeBrowsing" servers Firefox uses (there are bugs filed on that). If we did that we wouldn't need to fix the current algorithm.

Comment 2

[Milton Scritsmier]

I just looked over some messages which triggers the removal of the scam warning in plain text mode, and it appears that Daniel is right. In the other two view modes the displayed address and the actual address are different, while in plain text mode only the actual address is displayed.

Since this seems perfectly reasonable behavior to me, I am changing the status to INVALID. Sorry for the bad bug report.