--On 4. März 2015 05:33:44 -0600 John Wade <jwade@xxxxxxxxxx> wrote:
The tool we wrote for phishing scans the Cyrus imap server's imap spool file systems looking for a specific text string in specific user's mailboxes in recent messages. Te search can be done either recursively or just the inbox. It then looks for and replaces another specific text string (usually the phishing URL) with a string, like "Phishing URL removed by the Information Technology department".
Strictly speaking you would have to change the message's UID or the mailbox's UIDVALIDITY as well. Messages are guaranteed to be immutable by RFC 3501, section 2.3.1.1.
--
.:.Sebastian Hagedorn - Weyertal 121 (Gebäude 133), Zimmer 2.02.:.
.:.Regionales Rechenzentrum (RRZK).:.
.:.Universität zu Köln / Cologne University - ✆ +49-221-470-89578.:.Attachment:
p7sqO7Jyq9ZOi.p7s
Description: S/MIME cryptographic signature
---- Cyrus Home Page: http://www.cyrusimap.org/ List Archives/Info: http://lists.andrew.cmu.edu/pipermail/info-cyrus/ To Unsubscribe: https://lists.andrew.cmu.edu/mailman/listinfo/info-cyrus
