Reaching into Outlook s Toolbox | Secure Messaging with MicrosoftВ® Exchange Server 2003 (Pro-Other)

Apart from the well-known tools discussed earlier, Outlook also has some additional security capabilities; depending on what you re doing with Outlook, these might or might not be useful to you.

Configuring the Outlook Junk Mail Filter

Outlook s Junk Mail Filter, based on work originally done by Microsoft Research, is a very handy piece of technology. In previous versions of Outlook, Microsoft shipped some junk mail filters that did an acceptable job with the style and volume of spam that was prevalent at the time. The onslaught of spam we face now, however, calls for tougher measures. Outlook s filters are designed to provide automatic, client-side filtering that works in conjunction with the Exchange Information Store (as described in Chapter 8, SMTP Relaying and Spam Control ) and perimeter filters. However, the Outlook filters give good results even when used against IMAP or POP accounts.

Note

The Outlook Junk Mail Filter works for IMAP, POP, Hotmail, HTTP, and Exchange accounts. However, Exchange filtering only works when you use cached Exchange mode or delivery to a personal folder store (PST); the filters do not work with Exchange s online mode, and they don t work with third-party MAPI connectors like those from Bynari or Oracle. That raises an interesting issue, which I ll get to in a minute.

In addition to the built-in junk filter rules, which you cannot view or change, Outlook gives you another mechanism to control how mail is processed . There are three lists stored for each mailbox, either in the local PST file or the Exchange mailbox; when the lists are stored in the Exchange mailbox, they re available to the user whenever he or she logs in to Outlook or Outlook Web Access. The lists will probably sound pretty familiar:

The Safe Senders list contains e-mail addresses and domains that the user explicitly trusts. Mail sent from one of these addresses will never be flagged as junk. For example, my Safe Senders list contains microsoft.com so that mail sent from Microsoft addresses will never be flagged as junk.
The Safe Recipients list contains e-mail addresses and domains that the user expects to receive mail from. For users who have multiple e-mail services in a single profile, adding the Exchange mailbox s address to the Safe Recipients list prevents any mail sent to that address from being flagged as junk.
The Blocked Senders list is for people and organizations that you don t want to receive mail from. As with the Safe Recipients list, you can add individual domains or addresses to this list. Messages whose sender address or sender domain appear on this list are flagged as junk.

If you add the same sender or domain to the Safe Senders and Blocked Senders list (either accidentally or on purpose), Outlook errs on the side of conservatism and treats the message as safe.

Working with the Junk Mail Filters

Using the Junk Mail Filter is easy: as mail arrives, it s filtered, with varying degrees of aggressiveness, into the Junk E-Mail folder. You can inspect the contents of that folder at any time, deleting messages or marking them as you see fit.

The Junk E-Mail Options dialog box (see Figure 13-14) is accessible from the Junk E-Mail button on the General tab. You use this dialog box primarily to control the level of aggressiveness of the Junk Mail Filter. There are four levels:

Figure 13-14: The Junk E-Mail Options dialog box.

When you choose the No Automatic Filtering radio option, blocked senders mail is still moved to the junk folder, but the Junk Mail Filter itself is not run, so junk messages still end up in your Inbox. Because this level doesn t block inbound spam at all, it s probably not the best choice for most environments.
The Low option is the default setting; when the Junk Mail Filter is set to this level, obvious junk mail is filtered. I don t know exactly what obvious means in this context, but this setting does a decent job of catching most spam messages that escape common perimeter filters, and it has a very low false-positive rate.
The High option turns the Junk Mail Filter up a notch ; in this mode, Outlook is much more aggressive about mail that arouses its suspicions. As the option description in the dialog box notes, though, this mode might sidetrack some legitimate mail, too, so you should check the Junk E-Mail folder frequently.
The Safe Lists Only option is the ne plus ultra of spam filters: any inbound mail whose sender isn t on your Safe Senders or Safe Recipients list will go straight to the Junk E-Mail folder. This is a great way to limit the amount of mail you have to look at, but it will probably take a while until you get the Safe lists fleshed out enough for this mode to be useful.
The Permanently Delete Suspected Junk E-Mail check box is dangerous but useful. When you select it, Outlook removes any message that it otherwise would store in the Junk E-Mail folder. This minimizes the amount of time you have to spend cleaning up the junk folder, but it increases the risk that Outlook will delete some mail that you really wanted it to keep. In most cases, it s safer to leave this off, but if you have high spam traffic and you re comfortable with the filtering decisions of the Junk Mail Filter in Low mode, you might want to turn this option on.

As with most other Outlook 2003 settings, you can use GPOs to deploy and enforce these settings for users; look under User Configuration Administrative Templates Microsoft Office Outlook 2003 Tools Options Preferences Junk Mail in the Outlk11.adm GPO template.

Tweaking the Safe and Blocked Lists

What about adjusting the filtering lists? To add a message sender or recipient address to the Safe Senders, Safe Recipients, or Blocked Senders lists, you have two choices: you can use the tabs in the Junk E-Mail Options dialog box to manage the lists, or you can right-click individual messages and use the Junk E-Mail command on the shortcut menu to add the sender or recipient address or domain to the appropriate list. The tabs give you a greater degree of functionality, because they also include buttons for importing and exporting their respective lists to disk files. This is handy because it provides a way to quickly clone one mailbox s settings to other mailboxes on a small scale (for larger scale cloning, read on).

Creating Standardized Filter Lists

You can easily create a standardized set of Safe Senders, Safe Recipients, and Blocked Senders lists and deploy them as part of your initial Outlook 2003 deployment. You ll need to create the lists on a test computer, then use the Export To File button in each list s tab to save the files with unique names . Once that s done, you can use the Office Custom Installation Wizard to package the lists for deployment with Outlook. As described in the Office Resource Kit section on deploying Outlook 2003, the Custom Installation Wizard allows you to individually specify files for these lists and whether you want Outlook s setup routine to overwrite existing lists or append the new list to whatever the user s already defined.

Controlling Automatic Image Downloads

One favorite trick of spammers is the use of beacons or Web bugs ” small (usually 1 —1) images embedded in HTML e-mail. When the e-mail is opened, most HTML- aware e-mail clients attempt to fetch the embedded image from a server; a savvy spammer can use the Web server s logs (combined with information embedded in the message) to track information about the user who opened the message. It s very difficult to distinguish between legitimate images embedded in mail and those that serve as beacons, so Outlook 2003 helpfully defaults to not fetching any images linked to remote servers in HTML mail. Figure 13-15 shows what an inbound HTML message looks like with these images turned off; users can always restore the images by right- clicking one of the placeholders and selecting the Download Pictures command.

Figure 13-15: Outlook 2003 doesn t display inline images by default.

This behavior is controlled through the Change Automatic Download Settings button, which sharp-eyed readers might have noticed on the Security tab shown earlier in Figure 13-8. When you click this button, you ll see the Automatic Picture Download Settings dialog box shown in Figure 13-16; you can also open this dialog box by right-clicking an image placeholder and choosing the Change Automatic Download Settings command. The options in this dialog box are pretty straightforward:

The Don t Download Pictures Or Other Content Automatically in HTML E-Mail check box is selected by default; when it s selected, Outlook does not load images tagged with the IMG SRC tag if they point to a remote server. However, the behavior of this check box is modified by the two following check boxes.
The Permit Downloads In E-Mail Messages check box allows you to specify that you want images embedded in e-mail from people you trust. This is a handy way to bypass the default image blocking of Outlook for your mom, spouse, mailing lists, newsletters, or other sources that you trust not to spam you with Web bugs. This option is on by default.
The Permit Downloads From Web Sites check box controls whether Outlook downloads images where the tags point to sites in the Trusted IE security zone. Enabling this option allows Outlook to automatically download images only if the IMG tag points to a site that s in the Trusted security zone. Because you should already be careful about what sites you put in that zone, this option is on by default.
No matter what settings you apply here, Outlook will download embedded images when you forward or reply to an HTML message that contains them. This can effectively negate the protection you got in the first place, although you probably shouldn t be responding to spammers messages anyway. The Warn Me Before Downloading Content When Editing, Forwarding, Or Replying To E-Mail check box lets you ask Outlook to warn you before you do this. It s turned off by default.

Figure 13-16: Changing picture download settings.

Converting Inbound HTML Mail to Plaintext

The existence of HTML mail is a sore point for many mail users, particularly those who come from a UNIX background. On one hand, HTML mail can contain pretty colors, fonts, images, and so forth. On the other hand, it takes more space to store and transfer, and scripts embedded in HTML mail can do a variety of annoying or even destructive things. Users complaints found a sympathetic ear in the Outlook product group , so Outlook 2002 Service Pack 1 and later versions contain a feature that lets you forcibly convert all HTML mail to plaintext. Of course, this strips out all of the useful formatting, but it also renders impotent any scripts in the message, saving you from potential attacks that exploit Internet Explorer vulnerabilities. If you add a new DWORD value named ReadAsPlain to the HKEY_CURRENT_USER\Software\Microsoft\Office\10.0\Outlook\Options\Mail key, then give it a value of 1, Outlook converts HTML mail to plaintext, preserving embedded images as attachments. This doesn t affect signed or encrypted messages, but all other messages are updated as they re read. You can use this registry key in system policies or GPOs, as described in Microsoft Knowledge Base article 307594.

Encrypting RPC Traffic

RPC traffic between Outlook and Exchange Server is already compressed, and it s mostly unintelligible anyway. However, for added security (particularly for users who are using physically insecure links), you can force Outlook to encrypt RPC packets before they leave your computer. The encryption isn t as strong as the Windows VPN software, but you can use RPC encryption on your LAN or in conjunction with Microsoft ISA s MAPI RPC publishing feature ”both situations where VPNs would just get in the way.

This change needs to be made to each individual client, unfortunately , although it s supported by Outlook 2000 and later versions. To force Outlook to encrypt RPCs to the server, do the following:

Launch Outlook.
Choose the Tools E-Mail Accounts command. Verify that View Or Change Existing E-Mail Accounts is selected, and then click Next.
Select your Exchange e-mail account, and then click Change.
When the Exchange Server Settings dialog box opens, click More Settings.
In the Microsoft Exchange Server dialog box, click the Advanced tab.
Make sure that the When Using The Network check box is set, and then click OK to return to the E-Mail Accounts wizard.
Click Next and then click Finish.

Controlling Outlook Folder Home Pages

Outlook 2003 continues Outlook s provision of a useful but scary feature first delivered in Outlook 2000: the ability to use folder home pages so that visiting a folder automatically loads the Web page associated with that folder. This is particularly useful when used with public folders, because it allows you to associate content on an intranet (like a customer relationship management or enterprise resource planning system or other line-of-business application) with a folder. However, any scripts embedded in the page can make calls to the Outlook object model, so they can easily steal users mail, send mail, or do a variety of other potentially undesirable things. In the normal scheme of things, this is not a huge risk. However, because anyone who can create a public folder and tie a home page to it can potentially use that ability for evil, it s a good idea to watch out.

The Outlook 2003 policy template includes a policy called Disable Folder Home Pages (under Microsoft Office Outlook 2003\Miscellaneous\Folder home pages for Outlook special folders). When you enable this policy, it automatically blocks folder home page access for all users who are subject to the policy.