untangling_the_web

DID: 4046925
UNCLASSIFIEDNFOR OFFl61JtcL USE Qf4LY
A spreading threat involves something called image spam. Image spam uses HTML
code to display the email message, so spam filters cannot detect the spam because
there is no text. Some estimates place the amount of image spam at "15-25% of all
spam sent in the first half of 2006.,,189 Clever image spam emails appear to be plain
text messages to the casual observer, but in fact the entire message is nothing but
an image. While image spam at present appears to be mainly a nuisance, it has the
potential to become a threat as malicious hackers figure out ways to exploit it.
What can you do to protect yourself and others. First, never send HTML formatted
email. Period. It's easy to select the format for your outgoing email: 190
Outlook Express 6:
Tools I Options I Send I Mail Sending Format
select Plain Text
Outlook (most versions):
Tools I Options I Mail Format I Message Format I Choose
a format for outgoing mail I Send in this message format:
select Plain Text from pull-down menu
The next part is more complicated. Of the current versions of Microsoft's Outlook
and Outlook Express, only Outlook 2003 and Outlook Express 6 give users the
ability to disable HTML in messages received. This is a huge problem and one that a
lot of users have solved either by switching to another email client, such as Eudora,
or by installing a program, such as noHTML. As of now, if you use Outlook191 or
Netscape Messenger for email, you run the risk of falling victim to all the many perils
of HTML email.
Outlook 2003: to disable HTML in messages you receive
Tools I Options I Preferences I Email Options
189 Mike Chapple, "Battling Image Spam," Search Security.com, 15 August 2006,
(1 February 2007).
190 If you run a different email package, please check its help files for information on how to disable
HTML.
191 There is a way to disable HTML in Outlook 2000 using Tools I Macros I Visual Basic Editor, but it's
too complicated for my taste. However, for the less faint of heart, here's where you can get the
instructions (no guarantees on this one ...l've not tried it): "How to Disable HTML Email in Microsoft
Outlook," Ostrosoft, (14 November 2006).
548 UNCLASSIFIEDfiFOR OFFl6IJtcL USE ONLY