Forgot your password?
typodupeerror
Security United States IT

Department of Defense Now Blocking HTML Email 262

Posted by Zonk
from the nuke-them-from-orbit-only-way-to-be-sure dept.
oKAMi-InfoSec writes "The Department of Defense (DoD) has taken the step of blocking HTML-based email. They are also banning the use of Outlook Web Access email clients. The DoD is making this move because HTML messages can easily be infected with spyware and executable lines of code that enable hackers to access DoD networks, according to an article in Federal Computer Week by Bob Brewin . A spokesman for the Joint Task Force for Global Network Operations (JTF-GNO) claims that this is a response to an increased network threat condition. The network threat condition has risen from Information Condition 5 to Information Condition 4 (also called Infocon 4). InfoCon 5 is normal operating conditions and Infocon 4 comes as a result of 'continuing and sophisticated threats' against DoD Networks. The change to Infocon 4 came in mid-November, after the Naval War College suffered devastating attacks that required their entire system be taken offline, but the JTF-GNO spokesman claims there is no connection."
This discussion has been archived. No new comments can be posted.

Department of Defense Now Blocking HTML Email

Comments Filter:
  • Good call (Score:5, Insightful)

    by MostAwesomeDude (980382) on Sunday December 24, 2006 @05:22PM (#17355618) Homepage
    Reduced bandwidth, less entry vectors, less spam entering mailboxes. I guess the only losers are the people who send those annoying Flash giftcards through email.
    • Re: (Score:3, Informative)

      by Anonymous Coward
      I for one certainly don't miss the annoying pink backgrounds and purple text. But, you forget that a lot of internet based applications send out emails. So you should really include the developers in the losers category here.

      I don't know how many email templates I've gone though in the past week converting them to be plain text (where necessary). This mainly applies to processes that include sending tabular data to a person.
      • by tehwebguy (860335)
        "So you should really include the developers in the losers category here."

        which raises the question: why don't they just strip html out instead? it will probably require more work to make sure nothing gets through, but i think that it might be worth it.
        • by 1u3hr (530656)
          which raises the question: why don't they just strip html out instead?

          They do. "A Navy user said that any HTML messages sent to his account are automatically converted to plain text." But if you've used tables or such the layout will probably be trashed, so better to reformat as plain text to begin with.

          Using something like Lynx to filter HTML into plain text would give pretty good results, it does tables fairly well.

      • by shadowmas (697397)
        This is very true. I my self personally prefer plain text mail except when using outlook at the office where i use the default html or richtext.

        however when developing i do sometimes use html because it makes reading tabular data and such much easier to read at a glance. true you could use plain text for these but with lots of information it makes it difficult to quickly extract the information you need.
    • by Marcion (876801)
      End of HTML email? That would be my Christmas present sorted!

      P.S Merry Christmas to all you Slashdotters, Linux users, MS fan boys and Trolls.
    • Too late... (Score:4, Funny)

      by myowntrueself (607117) on Sunday December 24, 2006 @06:57PM (#17356194)
      the only losers are the people who send those annoying Flash giftcards through email

      Don't worry, they were already losers!

      • In the free world the media isn't government run; the government is media run. If that's truly your opinion, it's quite fearful. The media should report the news, not control the citizens or the government, regardless of whether it has third party influence.
    • Re: (Score:3, Interesting)

      by xdc (8753)
      Yes, this was absolutely the right choice. I just wonder what took them so long!

      I also wonder when other organizations will follow suit.
    • not entirely (Score:3, Insightful)

      My workplace recently did something similiar. I was never crazy about flashy colors and zillion font options. But I do miss the ability to send tables as part of the email. My job frequently involves info that is best represented in a table, and the ability to copy/paste a table into an email was very helpful. Even allowing for the limitations of plain text,

      Outlook did me the favor the other day of removing the "extra" line breaks, screwing up the already limited formatting I was stuck with. People

    • by mrmeval (662166)
      Anyone who lets emails in with links and attachments intact deserves what they get. It's trivially easy to strip that crap out.
  • As They Should (Score:5, Insightful)

    by deKernel (65640) <{timfbarber} {at} {yahoo.com}> on Sunday December 24, 2006 @05:26PM (#17355648)
    This I guess will just show my age, but I am soooo OK with this. Email should be just text, period. I personally believe that people should spend more time using complete sentences which includes punctuation and correct capitalization.

    I guess I should get back to chiseling my notes on stone slabs now.....
    • by theMerovingian (722983) on Sunday December 24, 2006 @05:52PM (#17355808) Journal

      Email should be just text, period.

      In my day email was dashes and dots, and we liked it that way.

    • Re:As They Should (Score:5, Interesting)

      by MobileTatsu-NJG (946591) on Sunday December 24, 2006 @05:53PM (#17355816)
      "Email should be just text, period."

      Personally I'd miss the formatting features of HTML. Bold, Italic, etc. I'm a little surprised there hasn't been a middle ground estbalished at some point. You know... pretty text, no exploits. Well, I can dream. In the mean time, gotta give kudos to GMail. One of my favorite features is that it disables images until you turn them on. That's a feature Outlook 2000 could have used.
      • by whoever57 (658626)
        When I first started using email, it was only within the company's WAN. Most people had exactly the same model of printer, so I figured out how to embed printer control characters into emails to make parts appear bold or in italics when printed (most employees printed out their email to read it at that time)
      • by Anonymous Coward on Sunday December 24, 2006 @06:10PM (#17355916)
        Personally I'd miss the formatting features of HTML. Bold, Italic, etc. I'm a little surprised there hasn't been a middle ground estbalished at some point. You know... pretty text, no exploits. Well, I can dream.



        I think that you have /really/ hit the nail on the proverbial head there. To make plain text emails usable we need a STRONG and well defined _SYNTAX_ for visually communicating "text style". Until then, this email thing will _never_ catch on.
        • Re: (Score:3, Insightful)

          by xTantrum (919048)
          you know i use to read /. for the interesting perspectives of the fellow geeks on here, but i've given up. I now read it for the comedians. wish i had my mod points.
        • Re: (Score:3, Interesting)

          by value_added (719364)
          I think that you have /really/ hit the nail on the proverbial head there. To make plain text emails usable we need a STRONG and well defined _SYNTAX_ for visually communicating "text style". Until then, this email thing will _never_ catch on.

          LOL. If the OP wants bold and underlining in his emails, I'd suggest he starts with reading

          T^HTh^Hhe^He M^HMu^Hut^Htt^Ht E^HE-^H-M^HMa^Hai^Hil^Hl^HCl^Hli^Hie^Hen^Hnt^Ht

          Personally, I'd find that annoying, like every other attempt to be interesting, or creative or otherw
        • I concede your point, mostly. But my bosses want tables. I need the ability to copy/paste tables and queries from Access into an email, and limiting my emails to plain-text means I have to copy/paste the text, then manually format the table into pretty columns. And the first time a boss forwards my email to someone else, the formatting is screwed up again. I don't need the full spectrum of HTML capability, but tables are useful. Give me the tabular environment from Latex, or something. People will jus
      • Re: (Score:3, Interesting)

        by dkf (304284)

        Personally I'd miss the formatting features of HTML. Bold, Italic, etc. I'm a little surprised there hasn't been a middle ground estbalished at some point.

        You should be aware that there has been such a format [wikipedia.org] for quite a while, using the MIME type of text/enriched. I used to receive quite a few emails that used it (no, I don't remember what the originating client was and I'm not interested in looking it up right now) but it never seemed to catch on more widely. (At a wild guess, that's because Outlook didn'

        • I remember getting an RTF-formatted email from my ISP back in 1995, when you would actually see RTF in the wild.

          I chose RTF as the format for my reply. I thought that was reasonable. (I forget what mail client I was using- maybe Eudora.)

          They wrote me back, again in RTF.
          "WTF is this? We can't open it."

          No, not WTF.
          Microsoft RTF.
      • by Arker (91948)
        There was such a thing, but MS decided it wasn't exploitable enough and declined to use it. Look up text/enriched.

      • Personally I'd miss the formatting features of HTML. Bold, Italic, etc. I'm a little surprised there hasn't been a middle ground estbalished at some point. You know... pretty text, no exploits.


        There is. Enriched text:

        http://www.ietf.org/rfc/rfc1896.txt [ietf.org]

        Which is really just a subset of HTML for the most part.

      • by 1u3hr (530656)
        . I'm a little surprised there hasn't been a middle ground estbalished at some point. You know... pretty text, no exploits.

        There is (was) a "rich text" for email, looked like a subset of HTML. It was used by early versions of Eudora and other mail clients. I think we can blame Netscape for putting HTML into email, and this was cemented when Outlook came along and started doing it by default. All the other mail clients had to follow though they knew it was a Bad Idea.

      • As an old boss once used to say, when presented with options - "Do Both!"

        I read all my e-mail as "plain text". After all, HTML is plain-text too.

        95% of the time that is all you need. Yeah, I can see they marked it italics or bold, but they are the same words.

        If, after looking at the "raw" text, and I really think the formatting will convey some additional info, I might look at it as "html". Looking at the raw text gives you a pretty good idea if there is anything sinister about it.

        In my experience,

    • Re: (Score:3, Funny)

      by pchan- (118053)
      But I just finished writing this inspirational xmas email in 32-point Comic Sans font with animated gifs of kittens and reindeer and attached 30-meg screensaver that I was going to sent to Everyone@dod.gov
    • All I can say is, the war in Iraq must be going really badly if the DoD is this desperate for additional recruits.
    • by mordors9 (665662)
      You young whippersnappers and your crazy ideas. Whatever happened to a good postcard.
    • by a.d.trick (894813)

      I don't know how old you are, but I'm still a college student and I share your feelings as well. What annoys me the worst is that retarted mail client called Outlook that has a love afair with <FONT SIZE=8 COLOR=BLUE> [1]. Text is wonderful because it allows me to specify the color, font family, and size of the email so I can read the blasted thing.

      Plain text isn't perfect either. Things like text formating is often done in awkward ways that can get screwed up fairly easily. (The 80 column line wrapp

      • by Megane (129182)

        I don't know how old you are, but I'm still a college student and I share your feelings as well. What annoys me the worst is that retarted mail client called Outlook that has a love afair with .

        ARGH! I know exactly what you mean. I used to work at a mostly MS-dominated company, full of people using Outhouse and MSexchange, and most e-mails would have those defaults, which would appear at an annoyingly small size under the OS X mail program. I always had to just give up and hit the command keys to show them as plain text. Having a mail program specify the font size BY DEFAULT in HTML mail is completely and thoroughly brain damaged, doubly so when the default is so small.

        And there's a small a

    • by t14m4t (205907) *
      Actually, Righ Text format is still authorized. I can still send e-mail with bold, italics, colors, etc. I just can't use any embedded HTML.

      For those who are interested, this is one of the (many) moves the DOD has taken over that past year or two in response to the continuing series of "F" grades DOD networks have received regarding their security. I'm the CIO at my command; I've had the "joy" of implemeting these changes - I took over the job right around the time the changes started.
  • At least then people will know why their email never got through. So many people use HTML email without being aware of it and don't realize that's what makes formatting possible.

    Although the focus is on Outlook, it seems like there's an outside chance there may be other clients and web interfaces (namely all of them) that are vulnerable to most of the same problems....
  • Stupid (Score:3, Interesting)

    by Nicopa (87617) <nico.lichtmaier@ ... .com minus punct> on Sunday December 24, 2006 @05:33PM (#17355686)
    That's stupid. The problem is not with HTML mail (which is generated by many people unknowingly). They could just standarize in a safe mail program, with some mandatory defaults. They could force the use of a modified version of Thunderbird forcing the (already existing) oprion of "Disable JavaScript" off. Another interesting Thunderbird feature is the ability to "sanitize HTML", that is, remove from the HTML view anything that isn't strictly formatting (paragraphs, bullet lists, etc.).
    • Re:Stupid (Score:5, Insightful)

      by Beryllium Sphere(tm) (193358) on Sunday December 24, 2006 @05:40PM (#17355744) Homepage Journal
      But even without Javascript there are still web bugs, image file parsing exploits, and remember what engine is probably parsing the HTML on a Windows client. A "safe" email client is one that disables most of the features of HTML, and unless it's guaranteed to catch everything dangerous then it's safer to prevent HTML in the first place.

      Up-to-date patches would mitigate those, but do you think somebody might be saving some zero-days for the DoD?
      • Use XML/Subset of XHTML (a la jabber messages) - the parser throws an error or ignores anything that isn't in its list of commands.
      • It shouldn't be rocket science to display a piece of formatted text while disallowing network connections or scripts.

        The fact that none of the major E-mail clients can be trusted to do this is a testament to the sad state of software engineering.
        • by 1u3hr (530656)
          The fact that none of the major E-mail clients can be trusted to do this is a testament to the sad state of software engineering.

          I think it's more that to get the same look as intended by the sender using an MS client, you have to use the IE renderer built in to Windows. Otherwise people complained it looked wrong. And this was no doubt a lot easier than writing your own renderer and keeping it up to date.

          Personally I stick with an ancient version of Eudora, which does have its own renderer. Sometimes i

    • by Stumbles (602007)
      No, it's not stupid.... doing nothing is stupid. The simple fact remains. No matter what client your using, be it proprietary or some open source variety all the nastiest that can be placed in HTML is simply a hassle to block. Sure you can run things like spamassassin, razor and any number of things but those are just extra things that have to be maintained, updated, etc. The simplest is to dump HTML altogether. I have never been a fan of HTML email because it's a colossal waste of bandwith.
      • by Belial6 (794905)
        I have never been a fan of HTML email either, but I think the 'waste of bandwidth' argument is long dead. Even a dial up modem has plenty of bandwidth to handle HTML email.
    • by headkase (533448)
      What's stupid is that they were not aware of the obviously better solution you know of. That's where targeted information needs to be supplied. Google is everyone's friend but sometimes it's still not easy enough to find the answers to your specific situation. The challenge being connecting the right answers with unknown information in the search queries. Google's next biggest challenge is finding what you didn't know you needed!
    • by drmerope (771119)
      No. Its the KISS principle. Code complexity itself endangers security.

      Rendering engines aren't rewritten frequently. Typically the code you have available for reuse supports many features you don't want: embedding, javascript, images (don't forget the GDI exploit). It is true that you can provide knobs to disable these dangerous features in the rendering engine. *BUT* have you ever been involved in real software verification efforts? Too many knobs means too little coverage.

      Writing good tests is hard.
    • Standardizing the DOD mail program is not the issue. Their problem is with *incoming* email. They have no control over what mail client Hotlipz in Tombstone Arizona is using to send a cutesy Christmas card executable to her boyfriend in Iraq...
    • by a.d.trick (894813)

      Maybe in the utopian land of happiness and glee. But for those of who live in the real world, it doesn't work so well. The fact is that software is buggy, and the more features it has, but buggier it tends to get. Security isn't a black and white thing. Most of the real decisions us real people have to make is based on a number of factors that we aren't quite certain about. Something like HTML email provides a much larger surface of attack and potential places for programmers to screw up. The most mail clie

    • by hey (83763)
      I just looked in my Thunderbird help - can't see any thing about "sanitize HTML".
      Can you please point me to this option. Thanks.
    • Re: (Score:3, Interesting)

      by mackyrae (999347)
      There are ways in HTML email of inserting 1-pixel transparent gifs which have unique load addresses based on who opens the email so that the sender know which people they mail read it. That's how spammers know if you open the spam they send. It's a sort of tracking cookie image.
  • If the DoD cannot find a solution to this kind of email, they should outsource its management to countries like India and Russia. Isn't it true that a good amount of our defense contracts are outsourced?
    • by ScentCone (795499)
      If the DoD cannot find a solution to this kind of email, they should outsource its management to countries like India and Russia. Isn't it true that a good amount of our defense contracts are outsourced?

      Um, they just did enact a solution.

      And, no. You don't really have Indian outsourcing operations involved in the day-to-day admin of communications to and from the Pentagon. No.
  • by erroneus (253617) on Sunday December 24, 2006 @05:36PM (#17355718) Homepage
    That's as obvious as the department of homeland security closing the borders!

    I applaud the effort, but why did they take so long to wise up even this much?
  • by Sepodati (746220) on Sunday December 24, 2006 @05:43PM (#17355758) Homepage
    Although vanilla access to OWA is being blocked, there are still ways to get to your email from outside of the network (mainly what OWA was used for, anyhow). You can VPN into the network, log on to OWA using your CAC (common access card, smart card, etc), use your Blackberry (assuming your rank is high enough to get one ;)).

    So instead of just plain old OWA sitting out there waiting for anyone to type in a username and password, they've upped the security a little bit. Yes, it's making us jump through hoops a little (for myself, need to stand up an ASA5510 as a VPN concentrator to receive outside connections), but it's not impossible.

    Besides... not being able to check your work email from home can only be a good thing, no?? I know, I know, it's for people on travel, leave, etc. too...

    As for the "blocking" of HTML email, can't say that I've seen that at all. Maybe it's only for emails that originate from outside of the network since we use HTML email all the time from within Outlook (formatting is useful in this case).

    ---John Holmes...
  • As long as stupid users dictate policy (and it always seems to be the most idiotic, uninformed, timetable pounding and ego-blinded of all users usually are in the upper echelons of an organization), security problems do to software choice will prevail. This is how microsnot products usually get pushed into an organization. Score one for the DoD getting rid of freaking html-mail and outhouse web access. One can only hope they s**tcan ms-exchange while they're at it.
  • Good! (Score:5, Informative)

    by porkThreeWays (895269) on Sunday December 24, 2006 @05:51PM (#17355806)
    Good! HTML email is very annoying. Most of the time it doesn't display as intended anyway. Many clients will only support a safer reduced set of html thus only parts of the page will display properly. This makes the page even harder to decipher. HTML email is really only useful for spammers and advertisers usually anyway. If something needs to be that heavily formatted, attach it as a word processor document. If you can't get a basic idea across in plain-text, then the problem probably isn't because you are missing your bold tag.
    • Re: (Score:3, Insightful)

      by Xugumad (39311)
      No, not a word processor document, please attach it as as PDF!
    • Off the top of my head, here's a use to which I've put HTML email in the past week and I found it useful. It was something like:

      "Alice, Bob and I have read your earlier queries and here are our replies. The black text below is the specific part of your email that we wish to comment on; the blue text is Bob's comments; the red text is my comments."
  • Temporary? (Score:5, Interesting)

    by Bluesman (104513) on Sunday December 24, 2006 @05:52PM (#17355812) Homepage
    This appears to be a temporary measure based on the current threat level.

    If the Infocon levels work anything like the other readiness levels in the DoD, then a shift to Infocon 4 requires a change (temporary) in policy. So it seems that a shift back to level 5 would mean HTML e-mail is no longer blocked.

    It's like after 9-11, when all DoD installations had much stricter physical access rules and extra guards at the gates.

    Which is a shame, because saying goodbye to html email entirely would be fine by me.
    • by Locutus (9039)
      good point but another option is to put an email cleanser inline to remove all problematic formating. Also, because they will probably not give up Microsoft software for this, they have to realize that a major change is needed for longterm protection.

      Who knows, maybe they will 86 MS LookOut.

      LoB
  • I work as a contractor to the Navy, and we received e-mails a few weeks back saying that HTML e-mail would no longer be allowed. However, they weren't blocking it, merely converting anything that was HTML to plain-text or RTF. I've not tested by sending an HTML e-mail to my .mil address (gonna try that in a few minutes), but I don't think they're actually blocking it.
  • I determined a couple of years ago that in order for the small IT department of one (me), to be able to keep up with potential Outlook security problems, I had to filter HTML down to Plain Text. When you've got a program that can be used to infect a computer just be previewing a message, you have to do _something_. Now that we've install Exchange (bleh), internal messages are no longer filtered, but thankfully the old filters for stuff going in (and out) of the company remain in use.
  • If you know how to use HTML, you should know how to be able to write an email without using any HTML.

    If you don't know how to use HTML, you shouldn't use it, period.
  • HTML wouldn't be such an exploitable thing with e-mail if Microsoft's mail software weren't so full of holes. If Outlook/Exchange is really that important to some organizations, why not offer support for [b]internal[/b] mail to be sent in Microsoft Word format?
    • why not offer support for [b]internal[/b] mail

      Given the topic of the OP, there's definitely some sort of irony here.
    • by LurkerXXX (667952)
      There have been exploits before in mozilla/thunderbird, eudora, etc.

      HTML doesn't belong in emails.

  • I block html email myself simply because it is annoying and 90+% is spam anyway. Why is this a problem?
  • Yay! How profound that what we've always known finally made it into the heads of the military. If you mix code into your data, you're screwed eventually. No way around it.

    That said, it's the JavaScript, not the HTML - formatting is data not code.

    Now if only they would figure out the same about Word/Excel.
  • well, you already know the answer. Too bad nobody at the DoD is willing to step up and ask why their *nix systems are not having these problems.

    LoB
  • by LibertineR (591918) on Sunday December 24, 2006 @07:01PM (#17356212)
    Folks, the DOD is NOT blocking HTML mail, just converting it to plain text and disabling scripts, something ANY Exchange admin should already be doing in addition to Sender ID.

    Instead of facts, we get just another bash Microsoft thread. Figures.

  • by truckaxle (883149) on Sunday December 24, 2006 @07:09PM (#17356246) Homepage
    Any here that are forced to use the NMCI (Navy/Marine Corps Intranet) network know that reading any email at all can be a challenge.

    A NMCI laptop takes over 10 minutes to boot and load the dozens of background processes and roving preferences. Once booted the machine is near useless performance wise.

    Most, including middle management, refer to NMCI as No More Computing In-house.

    In order to get idea just how bad things are, upper management conducted "customer satisfaction surveys". Even though the NMCI program office controlled the content, distribution, and analysis of the survey the results indicated overwhelming dissatisfaction. The NMCI program office has declined to release the raw data from the survey, instead issuing a release about the results. Rear Admiral J. B. Godwin III said releasing the results would challenge the "integrity of our data." Hmmm....

    Most Navy labs that are under the burden of the NMCI contract maintain two networks, the legacy and the NMCI - the one to get work done on an the other to read email. This leads to double the costs and double the vulnerability exposure, and halves the resources to concentrate on security and usability.

    Worst I hear that the Navy just extended the contract to 2010. Your tax dollars at work.
    • by Bios_Hakr (68586)
      NMCI is an admin's dream. CAC authentication means no more password issues. Locked-down desktops means no more shareware crap. Remote desktop and remote program installs means reduced admin visits.

      Of course, paying $5000 for a shitty computer sucks ass. Plus what, $500 per user? On top of that, you have to pay retail for every app you want.

      I have a CD-Burner in my NMCI machine. If I want NERO installed, I have to pay $300 for a cd-burner (because my build does not show a burner even though any idiot c
    • A NMCI laptop takes over 10 minutes to boot and load the dozens of background processes and roving preferences. Once booted the machine is near useless performance wise.

      That is so true. The Navy needed technical standards, not NMCI. The organization is too big and diverse for a one-size-fits-all solution. Application development has all but stopped outside of San Diego and EDS is running...or should say ruining...most of that. Layers of process and bureaucracy between the users and a usable product.

  • It sounds like DoD IT people hate users' freedom! Sounds like we've found an Al Quida sleeper cell right in the DoD!!!
  • I encode all my emails using WingDings font, so absolutely no-one can read them :) I can't do that in plain text!
  • It's not security, it's not size.. it's the bleedin' fact that every sodding day some bellend asks me how they insert >picture/video/stupidlink< into their email. I'm fed up with it! I'd rather feed their bones to pigs!

    Merry Christmas by the way.

    Incidentally, if those bloody angle brackets are the wrong way round - blame the sodding HTML! Merry Christmas again... and yes, I've been out getting lathered, deal with it! :o)
  • A lot of folks are going to say that this is overkill. A safe email client, patches, scanners, etc. should be "good enough". Well, if I was American (as opposed to Canadian), I'd say that this move by the DoD is a good one. Who cares if the risk is "small"? There is a higher risk with HTML email than plain text, and only marginal benefit. We are talking about an organization that needs to operate at very high levels of security.


  • From: Donald Rumsfield
    To: General Whosit
    Subject: My final Orders

    This email contains a computer trogan.

    You are so pwned!!!

    Sincerely
    Osama Bin Ladin.
    ____

    Yeah... Typos are on purpose

  • Why don't they simply add some format conversion feature on the border e-mail gateway ? That way, HTML messages gets converted plain text before delivery.
    Then again, maybe they use Exchange, and can't implement something of this sort. I know it is, if not trivial, relatively easy to implement on many F/OSS MTAs (namely exim).

Never appeal to a man's "better nature." He may not have one. Invoking his self-interest gives you more leverage. -- Lazarus Long

Working...