Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

False positive Link Fraud with quoted .com url #621

Open
Skywalker-11 opened this issue Oct 26, 2022 · 5 comments
Open

False positive Link Fraud with quoted .com url #621

Skywalker-11 opened this issue Oct 26, 2022 · 5 comments
Labels
bug Confirmed

Comments

@Skywalker-11
Copy link
Contributor

Skywalker-11 commented Oct 26, 2022 •
edited
Loading

Describe the bug
Quoted links eg. "http://example.com" are falsely identified as fraud url. This seems to only affect specific TLDs (here .com). Other TLDs eg. .de or fictional 3 letter TLDs like .bla seem to not be affected. The message Found phishing fraud from http://www.example.com claiming to be www."http: in <msg-id> is logged.

EDIT: Even when the url does not contain http://www. the log message looks like this Found phishing fraud from http://bla.example.com claiming to be www."http: in <msg-id>

To Reproduce
Send a mail with HTML only or HTML/plain-text mixed content which contains a link with quoted .com url eg.

Expected behavior

  • Quoted links with same url in the href and link text should not be treated as dangerous.
  • The .com TLD also shouldn't be handled differently than other TLDs regarding the fraud detection.

Examples

<html>
  <head>

    <meta http-equiv="content-type" content="text/html; charset=UTF-8">
  </head>
  <body>
    <a class="moz-txt-link-rfc2396E" href="http://www.example.com">"http://www.example.com"</a><br>
  </body>
</html>

Server (please complete the following information):

  • OS: Debian
  • MailScanner Version: 5.4.4-1
  • OS Version: 11
  • Installation method: Package + MailWatch
  • Installation: Upgraded via multiple steps from <v5.3
  • Containerized: No

Additional context
Notice: Thunderbird automatically creates the link in the example when someone uses "http://xyz.tld" in a normal text (without explicitly defining at as a link).
@shawniverson
Copy link
Member

Still looking at this one, trying to get caught up on these and others.

@Skywalker-11
Copy link
Contributor Author

Skywalker-11 commented Nov 21, 2022 •
edited
Loading

Adding $squashedtext =~ s/["'](.*)["']/$1/; here

v5/common/usr/share/MailScanner/perl/MailScanner/Message.pm

Line 7861 in 668cea1

$squashedtext =~ s/^(ht+ps?|ft+p|fpt+|mailto|webcal)[:;](\/\/)?(.*(\.|\%2e))/$3/i;
fixes the false positive for quotation marks at start/end of the link text.

These lines seem to be responsible for the different handling of .com tld and others. Do you know what the intention was for checking only these?

v5/common/usr/share/MailScanner/perl/MailScanner/Message.pm

Lines 7857 to 7858 in 668cea1

$squashedtext =~ /[.,](com|org|net|info|biz|ws)/i ||
$squashedtext =~ /[.,]com?[.,][a-z][a-z]/i ||

@shawniverson
Copy link
Member

@Skywalker-11 Those look like common tlds, albeit a limited list of them. I'm not sure what the intent was here, but they seem to be there to catch urls containing them, perhaps if the other conditions don't catch?

@shawniverson
Copy link
Member

Feel free to create a PR. I think your suggested substitution is good.

Skywalker-11 added a commit to Skywalker-11/mailscanner-v5 that referenced this issue Nov 25, 2022
@Skywalker-11
Ignore quotes at start/end of link text for fraud check
11feeae 
Fixes partly MailScanner#621
@Skywalker-11 Skywalker-11 mentioned this issue Nov 25, 2022
Merged
@Skywalker-11
Copy link
Contributor Author

The PR fixes the quoting issue but the different actions for those specific TLDs should probably still be looked at again.

shawniverson pushed a commit that referenced this issue Dec 4, 2022
@Skywalker-11
Ignore quotes at start/end of link text for fraud check (#630)
9908b08 
Fixes partly #621
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
bug Confirmed
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
2 participants
@shawniverson @Skywalker-11