Outlook Web Access corrupts HTML attachments

Windows Secrets Newsletter • Issue 155 • 2008-06-05 • Circulation: over 400,000

Table of contents

Introduction: Hong Kong readers: meet with me on June 15
Top Story: Outlook Web Access corrupts HTML attachments
Patch Watch: XP Service Pack 3: not yet ready for prime time
Wacky Web Week: You want me to spell what?
Best Software: Transfer mammoth files reliably for free
Woody's Windows: The hardware way to boost your productivity
Perimeter Scan: Take the mystery out of network-traffic analysis

Hong Kong readers: meet with me on June 15

By Brian Livingston

For many moons, I’ve wanted to hold a series of free seminars for Windows Secrets readers in various cities of the world.

I don’t really have an entire series worked out yet, but I’m doing kind of a trial run by offering a meeting with newsletter subscribers on June 15 in a single city: Hong Kong.

As you may remember, we gave four lucky readers in 2007 a Fred Langa Housecall — a one-on-one free seminar with our former editor, who wanted to discover the breadth of North America on his motorcycle before retiring from computer writing. We used the locale (country and postal code) that our subscribers had entered on their Windows Secrets preferences page to help decide where on his U.S. and Canada tour Fred would stop.

This year, if I held a free seminar in, say, Manhattan, I don’t know whether 10 or 10,000 readers would show up. So I’ve decided to start small in Hong Kong, a place where we have only about 200 subscribers.

Meeting with Brian Livingston
Sunday, June 15, 2008, 2:00–3:30 p.m.
Excelsior Hotel
281 Gloucester Road (near Causeway Bay metro station)
Hong Kong, PRC
Business Center, 33rd Floor, room number to be announced
(photo courtesy of the Excelsior)

If this little beta test works out, I hope to arrange meetings in future months in California, New York, London, Toronto, Sydney, and elsewhere. Let’s see how this first one goes.

As a seminar, my June 15 meeting is more like a “listening tour.” There won’t be any PowerPoint slides and I’m not selling any products or services. My goal is to learn from Windows Secrets subscribers how they use Microsoft’s operating system and how we can give you better information. It’ll just be me and a few readers, talking.

Considering that Hong Kong can be an expensive place, the Excelsior has offered us a private meeting room at a nominal rate. To guarantee an accurate count, Windows Secrets is collecting for pre-registration just $9 U.S. (about 70 Hong Kong dollars) per person, which is our cost for the tables, chairs, etc.

Yes, I’m sure if I actually knew a soul on the island, I could probably find something cheaper. If I can make future seminars truly free, I will.

Space is limited, and only Windows Secrets Newsletter subscribers may register. (Of course, anyone may subscribe for free to become eligible.) To let me know you’re coming, use the following link by 5 p.m. June 10 Pacific Time/8 a.m. June 11 Hong Kong Time:

Use this link to pre-register

Would you like Windows Secrets to hold a free seminar near you one of these days? Be sure your country and ZIP/postal code are correct in your WS preferences, so we can make plans. Visit your preferences page

Thanks for your support!

Meet Becky Waring, our newest columnist

This week’s newsletter marks the arrival of a new columnist with more than 20 years of experience as a tech writer and editor. Becky Waring (photo, left) will alternate with Scott Spanbauer in writing the Best Software column in our paid content.

Becky has been a frequent contributor to PC World, CNET, USAToday.com, Macworld Magazine, and many other tech publications and Web sites. From 2003 until just a couple of months ago, Becky was executive editor of JiWire.com, a leading Wi-Fi directory service. She also served as editor of New Media magazine.

In the Best Software column, Becky will put new freeware, shareware, and Web services to the test. This week, she tackles file-transfer services and identifies two that are a cut above the competition. As you’ll soon learn from reading her reviews, Becky has a real knack for finding a program’s best and worst features. I know you’ll enjoy her work.

Brian Livingston is editorial director of WindowsSecrets.com and the co-author of Windows Vista Secrets and 10 other books.

Top Story

Outlook Web Access corrupts HTML attachments

By Scott Dunn

The “Safe HTML” filter in Microsoft’s Outlook Web Access for Exchange Server deletes code from HTML attachments without warning.

Microsoft claims the filtering protects users by removing malicious elements, but the deletions can ruin a collaborative project and the “feature” isn’t present in any other Microsoft mail products.

Microsoft Exchange stealth-edits your e-mail

If you use Microsoft’s Outlook Web Access (OWA) to send someone an HTML file, don’t expect them to see any of the file’s comments or scripts. The file you receive may look completely normal, but Microsoft has edited the comments from the file along with other material the company considers dangerous.

It gets worse. According to Microsoft Knowledge Base article 899394, OWA may corrupt the structure of the message, remove some advanced functions, and eliminate other harmless content in the message itself or any attachments.

“Even if an e-mail message appears to be unmodified in Outlook 2003, that same e-mail message may be missing content when you view the message in Outlook Web Access,” the article states bluntly.

You needn’t even view the attachments to have them modified by the service. Merely right-clicking an attachment and saving it to your computer causes the file’s code to be stripped. Microsoft calls this feature of OWA “Safe HTML” filtering.

OWA is a component of Microsoft Exchange Server that provides a browser-accessible version of Microsoft Outlook for anyone who needs to access mail, calendar, and contact info remotely.

The filtering is intended to eliminate malicious scripts and “all potentially unsafe content” from the e-mail messages OWA receives, according to the Knowledge Base. However, as the KB article concedes, some “non-malicious content” may be removed in the process.

The feature was introduced with Exchange Server 2003, but remarks on a forum at MSExchange.org indicate that the filtering is still part of Exchange Server 2007. In one post, a user complains that OWA 2007 is removing JavaScript embedded in his HTML attachments.

It’s annoying enough to have the JavaScript edited out of your HTML files, but it’s difficult to comprehend how HTML comments, which are not executable, could contain malicious content.

HTML comments start with “<!–” and end with “–>”. They cannot contain the characters “–” or “>”. The comments are not visible in a browser unless you view the page source. They can also be seen if you open the file in a word processor or other text or HTML editor.

Such comments allow Web developers to insert instructions, feedback, and other information that may be useful to clients or co-workers. For example, a page’s visual designer could use comments to give coding instructions or feedback to the page’s HTML coder.

If the intended recipient of a comment receives the file via OWA, the page will look normal in a browser, but its HTML code will have no JavaScript or comments at all. OWA provides no warning of the deletion, so the recipient has no idea that the file ever contained any comments.

At least you’d know something is wrong with the file if the e-mail program blocked or deleted the attachment, popped up a warning, or added its own warning comments to the attachment. Simply editing the attachment without warning can be completely misleading to anyone who isn’t aware of this “feature.”

Outlook and other e-mail clients automatically block attachments with certain extensions, such as .js for JavaScript. But in these cases, a warning appears in the mail explaining that the attachment has been blocked.

Safe HTML filtering is found only in OWA. Neither the desktop version of Outlook nor Microsoft’s other mail products (Windows Live Hotmail online and the downloadable Windows Live Mail) edit the content of messages or their attachments. Consequently, users of OWA have no precedent to prepare them for or warn them about this behavior.

Stealth security does customers a disservice

Why would Microsoft create one version of Outlook that differs so significantly from the others? For that matter, why include this feature in only one of the company’s many mail products?

The Microsoft Knowledge Base article states:

“The filtering in Outlook Web Access for Exchange Server 2003 is more rigorous than the filtering in Microsoft Office Outlook 2003. The reason is that the Outlook Web Access browser interface has more security requirements than the Outlook 2003 interface.”

Unfortunately, the article does not explain why the OWA security requirements need to be stricter than those for Outlook itself. If the browser-based version of Outlook is inherently riskier than the desktop version, why isn’t Safe HTML filtering used in Microsoft’s other Web mail products?

No easy way to preserve your HTML files in OWA

The only workaround offered by the KB article is to post files that you don’t want corrupted to a shared network resource and then send the recipient a link to that location via e-mail.

An alternative is to compress your HTML files into a .zip file prior to sending them as e-mail attachments; OWA does not edit the contents of compressed files.

Of course, people expect the files they send via e-mail to be delivered in the same condition in which the files were sent. If a file can’t be sent for any reason, customers have every right to expect a warning or explanation.

OWA does neither. The service silently edits perfectly safe comments while giving the impression that your e-mail and attachments have arrived in the same state they were sent in.

It’s time for Microsoft to provide clear warnings of this behavior as well as an option for turning the “feature” off.

Readers receive gift certificates for a book, CD, or DVD of their choice for sending tips we print. Send us your tips via the Windows Secrets contact page.

Scott Dunn is associate editor of the Windows Secrets Newsletter. He has been a contributing editor of PC World since 1992 and currently writes for the Here’s How section of that magazine.

Patch Watch

XP Service Pack 3: not yet ready for prime time

By Susan Bradley

The growing list of XP SP3-related glitches being encountered by users should give pause to anyone thinking of downloading and installing the update.

If you’ve kept XP patched from week to week, there’s presently no clear advantage to implementing the OS’s latest service pack, though you’ll want to do so eventually.

When should you install XP Service Pack 3?

Since its initial release a little over a month ago — as I reported in last week’s special news update — XP Service Pack 3 has been plagued with reports of problems among early adopters. Considering that the service pack’s most important enhancements relate to computers on corporate networks, you may be wondering whether you need XP SP3 at all.

It comes down to a question of support: Microsoft supports each service pack for two years following the release of its successor. Thus in the spring of 2010, XP SP3 will be the only XP service pack that Microsoft will support. In addition, Microsoft has stated it will offer free support for those facing XP SP3 installation issues through April 2009.

If you have already installed XP SP3 and haven’t experienced any problems related to AMD processors, Norton AntiVirus’s SystemProtect, or any other service-pack glitch, you don’t need to remove SP3. However, if you haven’t yet installed XP SP3, hold off.

Instead, scroll down the Windows Update page each Patch Watch Tuesday and choose to install updates that do not include XP SP3. I’m starting to hear more reports of SP3-related driver problems. For example, Microsoft’s Knowledge Base article 951822 describes a free hotfix for a problem encountered when using certain models of Citizen or Alps printers after XP SP3 is installed.

This article is part of our paid content. Subscribe.

Already a paid subscriber? Click here to login.

Wacky Web Week

You want me to spell what?

As exciting television goes, spelling bees aren’t more than a notch or two above watching Congressional debates on CSPAN. They may lack the grimaces of mixed-martial-arts contestants, but in recent years the pre-teen contestants of the Scripps National Spelling Bee have supplied some high-level drama — and hilarious bloopers.

This year, the 13-year-old champion Sameer Mishra shows just how important it is to ask the word’s language of origin. “Can you use that in sentence please?” Play the video

Best Software

Transfer mammoth files reliably for free

By Becky Waring

File-transfer services make it easy and relatively reliable to exchange multi-gigabyte files with family, friends, or co-workers.

Xdrive and TransferBigFiles top the list of free file-transfer services, though each of the two imposes some limitations.

The challenge: transfer a 2GB video file

It all started innocuously enough. I simply needed to exchange a high-definition video file with a friend. Even zipped, the file was 2.4GB.

Forget e-mail. Gmail is the most generous Web-mail service for attachment size, but it tops out at 20MB. And YouSendIt’s free file-transfer service — which I frequently use and highly recommend for midsize transfers — maxes out at 100MB per file. My high-def file was more than 20 times that size.

It turns out the biggest obstacle to sending big files is not finding a free service to store them; it’s uploading the files in the first place. That 2.4GB file we wanted to exchange takes about 7 to 14 hours to transfer over a typical broadband connection (which often has an upload speed of just 384 to 768 Kbps, a fraction of its average download rate).

At first, my friend and I tried transferring the files directly between us via AOL Instant Messenger’s Send File feature. Knowing how long it would take, we started the transfer at night and hoped it would be done in the morning. The transfer wasn’t quite finished when I started work the next day, and I accidentally closed the AIM chat window, which aborted the process.

We made another attempt via AIM that evening, only to get a transmission error somewhere in the middle that again foiled the whole thing. Ultimately, we resorted to FedEx.

But now I was on a mission to find free services that could securely send and receive files of at least 300MB and, just as importantly, had a reliable resume feature for paused or interrupted uploads.

The pros and cons of the top two services

The hands-down file-transfer champ is AOL’s free Xdrive service, which requires only an AOL or AIM account. Xdrive offers 5GB of free storage and transfers single files as large as 2GB. You can upload files directly from the Xdrive site or use a desktop client to make the move.

I got the best transfer results using Xdrive’s Java applet running in Internet Explorer. Java enables a special upload accelerator that compresses files and resumes broken connections automatically.

By contrast, Xdrive’s beta desktop client was unreliable: It frequently dropped connections and offered no progress indicator for downloads. The desktop version also requires that you install the Adobe Integrated Runtime (AIR) environment for so-called rich Internet applications.

Once your files are uploaded, you select the document(s) on your Xdrive that you want to share with others and then e-mail them a download link. You can share entire folders and apply varying permissions: read, write, modify, delete, etc. (see Figure 1).

Xdrive's main file-transfer window

Figure 1. Sharing files with more than one person at a time is simple using Xdrive’s e-mail options.

Xdrive provides direct access to your AOL address book, which makes it easy to send files to multiple recipients at one time. Perhaps the best thing about Xdrive is that you can store the files for as long as you like. With most file transfer services, your uploaded files are deleted from the server after a week or so.

The only real downside to Xdrive is the service’s 5GB storage limit. If you want to send a number of files that, when combined, are larger than 5GB, try our runner-up transfer service, TransferBigFiles.

Along with the lack of an overall storage limit, TransferBigFiles is also easier to use than Xdrive. However, the service limits individual files to 1GB.

You don’t even need to sign up for an account to transfer files directly from the TransferBigFiles site. Still, I prefer to use the service’s handy DropZone utility, which you access via a system-tray icon. DropZone lets you drag and drop the files you want to transfer at any time. You can also queue multiple files for upload and resume after broken connections.

Another advantage of DropZone is that it lets you designate the recipient(s) at the same time you start the upload; with Xdrive you must first upload the file, and then send download links to the recipients.

Your files are saved on the TransferBigFiles servers for 10 days if you use DropZone, but for only five days if you transfer the files via your browser. I recommend using Internet Explorer to download the files; when I used Firefox to test the download service, some files failed to save properly.

While neither Xdrive nor TransferBigFiles will speed up your Internet connection — a 2.4GB file will still take all night to upload — they do take much of the pain out of the transfer process. Two features in particular make them worthwhile: they resume uploads after dropped connections, and they make sharing files with multiple recipients safe and easy.

The also-rans can’t accommodate monster files

I investigated at least a dozen services before narrowing the list to the two best candidates above. The major disqualifier was file-size limits: the free versions of YouSendIt and WikiSend restrict files to 100MB or less. That’s nowhere near large enough for my video files.

Several other file-transfer services looked like good bets until I tried them out. Pando has a 1GB-file size limit and offers unlimited uploads and a reliable suspend/resume feature. However, the service requires that the recipient download and install client software; all the other services simply send download links to your recipients.

More egregiously, the Pando installer is rife with crapware that you need to decline to avoid having it installed automatically on your PC.

Another service that seemed promising was Driveway, which limits files to 500MB and features a handy upload utility. However, I experienced too many problems with dropped connections and misguided links to half-uploaded files.

Similarly, the free version of SendSpace, which has a 300MB-file size limit and a highly capable transfer-management utility, looked great until I tried to download a file. Unfortunately, downloads are throttled to just 400 Kbps unless you have a paid account. Scratch that.

Becky Waring has worked as a writer and editor for PC World, NewMedia Magazine, CNET, The San Francisco Chronicle, Technology Review, Upside Magazine, and many other news sources. She alternates the Best Software column with Windows Secrets contributing editor Scott Spanbauer.

Woody's Windows

The hardware way to boost your productivity

By Woody Leonhard

You might think that my favorite PC timesaver would be a souped-up computer, a super-secret utility, or a settings tweak that makes Windows run at warp speed.

Nope. The tool that speeds my workday like no other is my ancient, indestructible Northgate keyboard — and while these babies have been out of production for years, I know how you can get your hands on a close approximation.

The saga of the perfect keyboard

In my column on May 8, I described how to reassign the keys on your keyboard. Many people use this trick to disable the obnoxious Caps Lock key. Some take the next step and reposition their Ctrl key back to the left of the A key, where the Ctrl-key gods intended it to be.

That column also mentioned my ancient Northgate OmniKey keyboard. I was thrilled to hear that many of you also swear by this antique beast. And therein lies a $200 tale.

Way back in the annals of computer prehistory (also known as the mid-1980s), Windows was just a gleam in some Xerox engineer’s eye and keyboards ruled the roost. There weren’t many mice outside user-interface labs, so there wasn’t any way to click File, Save to save a file, for example.

Instead, you saved a file by pressing a bizarre sequence of keys, such as Esc+T (for “Transfer,” of course) and then S (as in “Save”). If you were really clever and could remember such things, you pressed the Ctrl+F12 key combination to perform the same operation with one fewer keystroke.

This article is part of our paid content. Subscribe.

Already a paid subscriber? Click here to login.

Perimeter Scan

Take the mystery out of network-traffic analysis

By Ryan Russell

The free TCPView utility shows which programs are responsible for which network connections.

Free up bandwidth and stay safe by identifying the network links that you don’t need or that jeopardize your security.

Identify the apps that are reaching out

In my Apr. 24 column, I mentioned in passing Microsoft’s free TCPView utility (developed by Sysinternals), which displays all the network connections made to and from your computer and identifies the program responsible for each connection.

Suppose you find some interesting network traffic by using Wireshark, the packet-monitoring utility I described in the previous column, and you wonder which program is responsible for the transmission. Since Wireshark works at the network-driver level, the monitor has no idea which program is generating which packets.

In some cases, the source will be obvious from the traffic. For example, many ports are assigned to specific purposes. If a computer has connected to yours at port 1433, it’s a fairly safe bet that SQL Server is responsible for the connection, since the program is assigned to that port.

However, you probably have dozens of programs installed on your computer that are HTTP clients and thus use port 80. These include not only the obvious Web browsers but also any self-updating programs such as media players, games, and many Office-type applications. How do you know which program initiated the network session? TCPView can show you.

Link a program to its network connections

Unlike most other network-monitoring utilities, TCPView is simple and single-purpose. The program displays everything you need to see in one window, and you probably won’t need to change the utility’s default settings (see Figure 1).

Sysinternals' tcpview

Figure 1. TCPView shows you the program behind the network link.

The Process column tells you the name of the program initiating the connection, which is the information you’re after most of the time. If you see suspicious traffic in Wireshark or another packet-monitoring program, note its IP addresses, port numbers, and protocol. Open TCPView and use the information from the packet monitor to identify the program.

About 95% of the time I use TCPView to track down the app behind a connection, I think to myself, “Well, that explains it” and leave things as is. The rest of the time, I decide that the program in question doesn’t need to be dialing out and shut it off. On rare occasions I find something really wrong, such as an active piece of malware that needs to be removed from the computer.

The program’s network-monitoring blind spots

TCPView is live-view-style, which means the information displayed by the utility eventually vanishes from the screen. If you don’t act fast, you may not see your active network ports listed. TCP connections stick around in a waiting state for a short period of time after they close, so you usually have a minute or two to identify them.

Also, the program seems to monitor only TCP and UDP connections. If you open a command prompt and ping an IP address, the connection will not show in TCPView’s window. This is usually a problem only if something really stealthy is communicating via a custom protocol.

One final bit of strangeness: on my XP system, a number of outbound HTTP connections claimed to be coming from [System Process]:0. This worried me a little bit.

However, by monitoring traffic and applying the process of elimination, I discovered that the links were established by the iGridd Java applet for solving Griddlers logic puzzles. Griddlers are an entertaining — and harmless — waste of time. It would appear that Java does something a little funny with its network communications.

The Perimeter Scan column gives you the facts you need to test your systems to prevent weaknesses. Ryan Russell is quality assurance manager at BigFix Inc., a configuration management company. He moderated the vuln-dev mailing list for three years under the alias “Blue Boar.” He was the lead author of Hack-Proofing Your Network, 2nd Ed., and the technical editor of the Stealing the Network book series.

YOUR SUBSCRIPTION

The Windows Secrets Newsletter is published weekly on the 1st through 4th Thursdays of each month, plus occasional news updates. We skip an issue on the 5th Thursday of any month, the week of Thanksgiving, and the last two weeks of August and December. Windows Secrets is a continuation of four merged publications: Brian's Buzz on Windows and Woody's Windows Watch in 2004, the LangaList in 2006, and the Support Alert Newsletter in 2008.

Publisher: WindowsSecrets.com, 1218 Third Ave., Suite 1515, Seattle, WA 98101 USA. Vendors, please send no unsolicited packages to this address (readers' letters are fine).

Editor in chief: Tracey Capen. Senior editors: Fred Langa, Woody Leonhard. Copyeditor: Roberta Scholz. Program director: Tony Johnston. Contributing editors: Yardena Arar, Susan Bradley, Scott Dunn, Michael Lasky, Scott Mace, Ryan Russell, Lincoln Spector, Robert Vamosi, Becky Waring. Product manager: Andy Boyd. Advertising director: Eric Gilley.

Trademarks: Microsoft and Windows are registered trademarks of Microsoft Corporation. The Windows Secrets series of books is published by Wiley Publishing Inc. The Windows Secrets Newsletter, WindowsSecrets.com, Support Alert, LangaList, LangaList Plus, WinFind, Security Baseline, Patch Watch, Perimeter Scan, Wacky Web Week, the Logo Design (W, S or road, and Star), and the slogan Everything Microsoft Forgot to Mention all are trademarks and service marks of WindowsSecrets.com. All other marks are the trademarks or service marks of their respective owners.

HOW TO SUBSCRIBE: Anyone may subscribe to this newsletter by visiting our free signup page.

WE GUARANTEE YOUR PRIVACY:

1. We will never sell, rent, or give away your address to any outside party, ever.
2. We will never send you any unrequested e-mail, besides newsletter updates.
3. All unsubscribe requests are honored immediately, period. Privacy policy

HOW TO UNSUBSCRIBE: To unsubscribe from the Windows Secrets Newsletter,

Visit our Unsubscribe page.

Table of contents

Top-scoring articles in the past 12 months

Internet Services

Web Development

Digital Marketing

Consumer Tech