🚀 go-pugleaf

"Lex Hilton" <lexy007@home.bigpond.net.au> wrote in message news:c3d9238111c4b349c4724519faf92536@free.teranews.com...
> Not sure how many of you know about this piece of software.
> 
> It sends alerts to the original sender of email once you've opened it.
> 
> http://www.msgtag.com
> 
> A lot of my friends have started using it when sending me email.
> 
> Doesn't bother me but I was wondering if there's any way it can be defeated?
> 

Depends on how they coded it. You can include HTML in straight text emails and thus bypass reading ONLY in text but the simplest way would be to have a firewall that blocks port 80 for your OE only. I think you will find that port 80 is what is being accessed by that program. I may be wrong.

On Sat, 26 Jul 2003 12:56:10 GMT, "Lex Hilton"
<lexy007@home.bigpond.net.au> wrote:

> It sends alerts to the original sender of email once you've opened it.
> http://www.msgtag.com
> Doesn't bother me but I was wondering if there's any way it can be defeated?

The MSGTAB faq says: "MSGTAG relies on an embedded image in the
tagged message." In other words, a tagged message contains a link
to an image on the msgtag company's computer. Reading the email
accesses the image, and that's how they know you've read it.

So to disable MSGTAG, configure your email client not to
automatically interpret HTML, or at least not to access external
sites. Good email clients come already configured this way. If
your program doesn't have such an option, it should be considered
a security risk and not be used.

Such image tracking is also used by spammers to confirm that their
spam is being read. Disabling it will prevent you address from
being known as a "live" one and might cut down on spam.

Paul Guertin
pg@sff.net

Lex Hilton wrote:
> Not sure how many of you know about this piece of software.
>
> It sends alerts to the original sender of email once you've opened it.
>
> http://www.msgtag.com
>
> A lot of my friends have started using it when sending me email.
>
> Doesn't bother me but I was wondering if there's any way it can be
> defeated?
>
>
> Lex
IN OE6 go to Tools, Options, Read tab, and check the line "Read all messages
in Plain text."
Then have your friend? send you an email and see if they still get a read
response from you.
Also in Tools, Options, there is a Reciepts tab.  They can use that to get a
response back from you without having to use an external program.  Plus you
have the option of not responding to it.

Could you let us know if reading in text only stops if or not?   Thanks.
--
Ron & Ree Williams - http://www.ronree.com/
"Imagination is more important than knowledge." - Albert Einstein

"Lex Hilton" <lexy007@home.bigpond.net.au> wrote in message
news:c3d9238111c4b349c4724519faf92536@free.teranews.com
> Not sure how many of you know about this piece of software.
>
> It sends alerts to the original sender of email once you've opened it.
>
> http://www.msgtag.com
>
> A lot of my friends have started using it when sending me email.
>
> Doesn't bother me but I was wondering if there's any way it can be
> defeated?
>
>
> Lex

Get SpamPal (www.spampal.org) and its HTML-Modify plug-in.  Both are
free.  Besides SpamPal assisting in determining which e-mails are spam,
the plug-in will strip HTML-formatted e-mails to remove the nasties,
like web bugs and graphics with external links (which need to connect
"home" to get the image). Scripts get stripped, too, along with several
other tricks used in HTML-formatted e-mails.  By default, the plug-in
will leave along any inline images in the e-mail (these are embedded
within the e-mail itself and do not have external links to retrieve and
display them).

If you go this route by using SpamPal and the HTML-Modify plug-in,
please report back here if it worked to disinfect your HTML-formatted
e-mails of this MsgTag spying, or at least inform the plug-in author
that it isn't working so he can update his plug-in to also filter out
that crap.

And tell your friends to request read receipts for their e-mail that
gets delivered to you.  You can configure Outlook as to how to handle
read receipts.  The default is to prompt you for what action to take.
For work e-mails, I send a read receipt (because some e-mails are time
sensitive and the read receipt may be used to determine when to send a
follow-up e-mail if the sender doesn't know that you have already read
it).  For all other e-mails, I don't send read receipts.

Hmm, I started to ponder this "service".  What a marvelous way to have
users freely offer up not only their e-mail address but also the e-mail
address of everyone to whom they send e-mail (with these tags).  Looks
like I'll mention this over in the anti-spam newsgroups to see if anyone
over there considers this a primo mechanism for harvesting e-mail
addresses.  Their privacy says they will protect your personal
information, but then liars don't care about their promises.  I'm not
calling them liars but just noting that this service has a huge
potential for abuse.  Some interesting articles:

    http://www.theregister.co.uk/content/55/29289.html
    http://tinyurl.com/i64m

Of course, for recipients that do not have an always-on connection,
reading their e-mails while offline would never "phone home" anyway
since there is no connection at the time the message was read.  It only
works if you are currently connected while reading your e-mail so it can
"phone home" (via scripts and/or linked images).  For dial-up users that
retrieve their e-mails, disconnect, and then read their e-mail, this tag
scheme will not work.  I believe the number of dial-up e-mail users
still far outnumbers the number of cable/DSL e-mail users.

Since my Outlook is configured under Security options to use the
settings in the Restricted Sites zone (the default, I think).  Scripting
won't work in e-mails since the Restricted Sites zone is currently
configured to disable java and active scripting along with most other
features.  Outlook uses IE libraries to render HTML-formatted e-mails
but tests at security sites have shown that my IE does not divulge my
e-mail address.  But that may be due to my firewall rather than IE.  So
they can't run a embedded script in the HTML-formatted e-mail to talk
back to their servers.  They cannot get my e-mail address reported back
to them when I open the HTML "page" to display the e-mail.  And
uploading images from their server to my computer only gives them the IP
address on my host and not my e-mail address (of which I have several).
So I suspect they place a unique image in the HTML-formatted e-mail so a
retrieve of that image identifies that particular e-mail got received,
and the use of that image references the e-mail address to which the
e-mail was sent (and your e-mail because you had to have an account to
use their service).  Obviously their scheme will fail if you send
plain-text messages - unless they then convert them to HTML containing
that text, but the reason you send plain-text is to ensure the recipient
can read your e-mail since their e-mail client may not support HTML.
And if Microsoft ever gets around to adding a security setting for
*linked* graphics that lets you select to disable, prompt, or allow them
then it would be easy enough to customize the Restricted Sites zone even
further by disabling linked graphics which would disable MsgTag and
spammers that also use this trick.  This product seems targeted for use
by neophyte senders for e-mail received by equally neophyte recipients
who have never done anything beyond the default setup of the install for
their e-mail client and also presumes that the ISPs are taking no action
to protect their customers against this spammer trick.  The use of these
tags is also illegal in some areas as the recipient isn't aware of them
until after the fact.  Once the e-mail is opened to see that the tag has
been used, it is too late and the tag has already been used (provided
the recipient was online at the time they opened the tagged e-mail).

While this might utilize a trick (web beacons) that's been in use by
spammer web sites for a long time, it still means you have one source
than can harvest e-mail addresses.  I was thinking that perhaps I could
use an e-mail alias assigned for use only by MsgTag so they never knew
my real e-mail address (see Sneakemail.com, SpamEx.com, and
SpamMotel.com on using e-mail aliases).  If I ever started to get
spammed through that e-mail alias then I would know they were selling
off those harvested e-mail addresses.  However, you have to install
software on your computer and this itself can report to their servers
what are your e-mail address(es).  If their installed software always
inserts the same tag in your outbound e-mails (i.e., a tag that has only
been assigned to you) then maybe an e-mail alias to open an account on
their server would protect me.  The server sees the tag's retrieval and
sends back a response e-mail to the e-mail address specified in my
account with them - which is my e-mail alias instead of my real e-mail
address.  As to what their installed software might report back to the
servers, well, that would take some packet sniffing and investigating
that I wouldn't get into.

They have their free version but also paid-for versions with more
features.  If they are relying on the freebie users eventually moving on
up to their paid services and making their revenue from that (so they
can pay for all the expenses involved in providing the service) then
they may actually never release those potentially harvested e-mail
addresses of senders and recipients.

MsgTag runs as a local proxy.  If you are using other proxies, like
YahooPOPs to send e-mails through your Yahoo account, it can get tricky
to get the proxies in line and talking to each other okay.  They
probably want to supports lots of e-mail clients, and a plug-in would
restrict them to only those e-mail clients that support plug-ins.
Outlook supports plug-ins.  Outlook Express does not.  Their freebie
version will also corrupt your outbound e-mails by adding a promotional
signature at the end telling your recipients about MsgTag, so you become
an involuntary spammer for their service.  It's like the promotional
spam signature that Hotmail and Yahoo put at the end of your outbound
e-mails if you use their service to send e-mails (and why I use
YahooPOPs to retrieve Yahoo e-mails but use my ISP's SMTP server so my
outbound e-mails don't become mini-spams).

"GB" <gb@sonicresearch.mailme.org> wrote in message
news:zzEUa.371$gS.28523@nnrp1.ozemail.com.au...
> "Lex Hilton" <lexy007@home.bigpond.net.au> wrote in
> news:c3d9238111c4b349c4724519faf92536@free.teranews.com:
> > Not sure how many of you know about this piece of software.
>
>  We do now :-)
>
> > It sends alerts to the original sender of email once you've opened it.
> > http://www.msgtag.com
> > A lot of my friends have started using it when sending me email.
>
>  You need a new set of friends, ones who don't bug their email,
> and otherwise spy on their 'friends'...
>
>  (With fronds like these, who needs enemas?)
>
>
> > Doesn't bother me but I was wondering if there's any way it can be
> > defeated?
>
>  Yes, as it happens. Always keen for a challenge, I downloaded
> a copy to see why it works. Wasn't much of a challenge, but then
> that's a good thing I guess. All the 'best' 'technologies' are
> simple at heart.
>
>  After a quick dig about, it seems that this MSGBOX thing works
> like this:
>
>
> Sender's End
> ------------
>  Installing on the 'Senders' machine runs through a common-or-
> garden Windows install program, then invites the end user to
> sign up for an 'account' with a MSGTAG server.
>
>  When you first say 'Yup, I wan't to sign up', it attempts a
> connection to a server called 'logic.msgtag.com', POSTs 28
> bytes of something (I didn't look at what) and gets a reply.
>
> (Post: Interestingly, MSGTAG is happy to operate through HTTP
>        proxies at every step of the way, and making it work
>        through a 'Proxomitron' content stripping proxy actually
>        breaks this initial setup phase for MSGTAG)
>
> If it's happy with the reply (plural actually) (which, amongst
> other things, includes a png image of one of those "type the
> letters in the picture" things, to prevent automated registrations,
> it prompts for an email address (to send read reciepts to) and
> a password.
>
>  Sending that lot checks to make sure that the email address
> appears to be a real one, then invites you to receive their
> spam (default: yes), and says "welcome!".
>
>  After the 'registration', it trawls around, finds your email
> clients, and presents a list of your accounts, asking which
> ones you want to use with MSGTAG.
>
>  I chose one of mine, and it reconfigured only the 'Outgoing
> Mail' server to be 'localhost', and port '7362'.
>
>  As you've by now guessed, the crux of this MSGTAG thing is
> in that it installs an SMTP Relay on the Sender's machine,
> and reconfigures the mail client to use it.
>
>  The SMTP relay listens on 7362/tcp, and binds to all interfaces.
> It accepts connections from other machines, but immediately
> drops any connection from other than localhost. Watch this
> space, that will get exploited sometime RSN.
>
>
> Sending Email
> -------------
> When the end-user composes an email message, nothing changes.
> They compose and send exactly as they always had done.
>
> Their client sends to the local SMTP relay. The relay takes
> the message, converts it to a Multipart MIME message if it
> wasn't one already, and generates the typical one part plain
> text, one part HTML message.
>
>  At the bottom of the HTML section, it inserts a single cell
> table, something like this...
>
>   <p><table width="100%" bgcolor="#eeeeee"><tr><td width="100%">
>   <a href="http://msgtag.com/?source=ffooter"><img src="
>   http://img.msgtag.com/bD/mwrudtqrybpqqcdd/bi/Fpj/mx/uf/hvxi.gif"
>   border="0"></a> has notified the sender that this message has been
>   received.</td></tr></table><p></body></html>
>
> (all on one line, remove my indent spaces if you're going to try it).
>
>  The <img src="http://img.msgtag.com/...> image is a classic 'web
> bug', with identifying information specific to this individual
> email.
>
> Astute punters are, by now, realising that this is trivial to
> defeat, in a range of different ways :-)
>
>  Interestingly, apart from doctoring the MIME headers as required,
> MSGTAG doesn't seem to alter the message headers at all. Similarly,
> when it does it's SMTP relay thing, it doesn't identify itself
> as being involved, it just echos back the real upstream SMTP
> server's replies.
>
>
> Victim (Receiver) End
> ---------------------
>  At the recipient end, end-user fires up his email client, receives
> email, and views the bugged email. If his client is HTML enabled,
> and has a current live connection to the net, it will, of course,
> run off and download that image from img.msgtag.com.
>
>  I tested and, as one would expect, it is the downloading of the
> image with the coded url that triggers the sending of the read
> receipt.
>
>
> Defeating (The real reason we're here)
> --------------------------------------
> There are, of course, several ways to break MSGTAG from the Victim's
> point of view...
>
> 1) Edit /etc/hosts (c:\windows\system32\drivers\etc\hosts on NT/XP/2K),
>    (c:\window\hosts on 95/98/ME) (if 'hosts' doesn't exist, copy
>    'hosts.sam' to 'hosts' (making sure that it really is 'hosts' with
>    no extension, etc) or just create an empty file called 'hosts'
>    (make sure there's no .txt extension, etc)
>
>    put a line that reads:
>
>    127.0.0.1     img.msgtag.com
>
>    in the hosts file. (Note that this works equally well for
>    ads.icq.com in older versions of the official icq client (for
>    current version of ICQ Pro, replace the
>    \program files\icq\AteBrowser\123456\cache directory with an
>    empty, read-only file called 'cache' (no extension))
>
>    Restart things. When your mail client goes for the MSGTAG image
>    in the future, it will resolve 'img.msgtag.com' to localhost
>    (127.0.0.1) and try to receive the image from your own machine.
>    Since the image isn't there, it won't work. Elegantly simple.
>
>    Of course, there are numerous reasons why this, alone, might
>    not work. I've done this fiddling on a Windows box running
>    Internet Explorer, if you use another browser, your mileage
>    may vary (but the principles remain the same).
>
>    If your browser/mail client (in Windows, with IE and Outlook/
>    Outlook Express, the browser *IS* the mail client *is* the
>    Browser (thanks for nothing, US DOJ)) is configured to use a
>    proxy or a cache, it may refer the request for the MSGTAG
>    image off to the proxy/cache without ever referencing your
>    local /etc/hosts file.
>
>    Even turning on 'Bypass proxy server for local addresses'
>    didn't stop my browser/email client from loading the image.
>
>    In Internet Explorer, Tools -> Options -> Connections ->
>    LAN Settings -> Advanced -> Do not use proxy server for
>    addresses beginning with 'img.msgtag.com' fixed that little
>    problem.
>
>    If you're using dial-up straight from your Windows box,
>    the setting might be in Tools -> Options -> Connections ->
>    Dial-Up and VPN Settings -> <MY_ISP> -> Settings...
>
>
> 2) Tell your email client to ignore HTML content. As one poster
>    already suggested, telling the email client to ignore HTML
>    also, of course, works fine.
>
>    With Outlook Express 6, Tools -> Options -> Read ->
>    'Read all messages in plain text' does the trick. Sometimes
>    a restart is required to make it work, OE is wierd like
>    that. Also, since Microsoft made OE and that dodgy messaging
>    client 'Windows Messenger' one inseverable blob, exiting
>    OE doesn't mean exiting OE. With NT/2K/XP, ctrl-shift-esc,
>    find msimn.exe, and 'End Task'. Thanks again, for nothing,
>    go to the apparently toothless US Department of Justice.
>
> 3) Use a proxy to your advantage. Get an ad blocking (like
>    Guidescope) or content stripping (like Proxomitron) proxy
>    and use them to strip or otherwise munge the
>    http://img.msgtag.com/... request so that it doesn't happen,
>    or doesn't work.
>
>    The side bonus with one of these is that you get to browse
>    without ads and cookies and rubbish clouding the 'experience'.
>
>
> Why MSGTAG doesn't work with Outlook/Exchange Combination
> -------------------------------------------------------
> Outlook (not Outlook Express) sending and receiving email through
> a Microsoft Exchange server in a corporate environment doesn't
> use SMTP to send emails, so the MSGTAG system doesn't work
> with that (ie: you can't send emails tagged with MSGTAG 'bugs'
> from Outlook/Exchange.
>
> You can still be a 'victim' though. If someone working through
> a conventional POP/IMAP/SMTP system sends you a bugged message,
> your Outlook/Exchange setup will happily comply.
>
>
> For future research
> -------------------
> It occurs to me that there are endless opportunities for invasion
> of privacy, and collection of personal and personally identifying
> information here. I spent less time testing this program than I
> did writing this article, so I haven't looked into what the
> MSGBOX SMTP relay sends upstream to msgbox.com servers, nor have
> I looked at what the setup program communicates to logic.msgbox.com.
>
> Most folks are smart enough to realise that collecting info and
> doing other dodgy things is a one way trip to corporate obscurity
> in/on today's internet, but if people as big as Microsoft are still
> dumb enough to do it, then you can bet your bottom dollar that
> the little people will, from time to time, be silly enough to
> try it too.
>
> Other interested parties may be interested to have a futher dig
> at this bit of software, and the chattering that goes on behind
> the scenes. I, for one, would be interested to know.
>
> For now, I'm off to re-image and wipe-out the test box!
>
>
>  Hope this helps,
>
> G

Thank you!  Very interesting and helpful.

Andy

GB <gb@sonicresearch.mailme.org> wrote in 
news:zzEUa.371$gS.28523@nnrp1.ozemail.com.au:

> Hope this helps

Thanks GB, 

Very helpful and informative. 


There is 'the' resource site for the Hosts file setup and maintenance.
 
http://www.accs-net.com/hosts/ by Gorilla Design Studio

Posted on July 22nd, 2003 
http://www.accs-net.com/hosts/get_hosts.html

"Update: As of Summer 2003, Stephen Martin is no longer maintaining a hosts 
file. If you want one of his versions, you may download the February 7th, 
2003 file from the archives below. The current hosts file is now maintained 
by Mike Meyer, author of HostsToggle , and the link above will get you his 
latest version, in the 127.0.0.1 format. If you would prefer to have the 
file in the 0.0.0.0 format, please download this file instead. The Hosts 
file now has over 19,000 entries.

Updates to the Hosts file come from submissions sent to Mike Meyer by the 
Hosts file users. Those submissions are assumed to be accurate and are 
taken in good faith as valid ad servers. If any particular entries are not 
ad servers, please send a note to Mike and he will gladly remove them."
...

In addition to disabling HTML in email, both sending and receiving, part of 
my protocol for email also includes reading/writing/answering email OFF-
LINE.

I was wondering if you have seen any 'web bugs' that might defeat opening 
and working with email off-line by delaying the sending of a web bug until 
there is a live connection to the Internet? 

Thanks, 

Gary