Little Snitch catching spam server connections

Question

Little Snitch catching spam server connections

I just installed Little Snitch, an outbound firewall application. I set up this application to ask me whenever a local application attempts a connection to the internet.

Well, since installing it, I have to constantly block Mail from connecting to various servers that are related to spam emails I get. If I actually look at the spam messages, none of the images are loaded, and that's what I want.

Why is Mail connecting to these servers? Am I missing a setting somewhere that prevents this?

MacBook Pro (mid 2009), Mac OS X (10.6.1)

Posted on Oct 26, 2009 4:25 PM

Reply

Answer 1

Anakonda

Level 2

340 points

Oct 26, 2009 5:13 PM in response to Dan Rosenfeld

Hi Dan,

open Mail -> Preferences -> Viewing,
uncheck the box "Display remote images in HTML messages".
This should help.

Anakonda

Reply

Answer 2

Oct 26, 2009 9:32 PM in response to Anakonda

Yeah, I already have that unchecked. That's why I posted the question here. Seems like I've set everything correctly, but Mail still wants to make outbound connections.

Dan

Reply

Answer 3

Oct 27, 2009 11:43 AM in response to Dan Rosenfeld

I've noticed Little Snitch v2.2.05 does catch quite a few outbound connections lately from mail and not exclusive to just spam. If fact, it's been a lot more active outside of the browsers in the past month..

IMO, might be just a warning to indicate how venerable are systems are becoming...

Reply

Answer 4

Oct 27, 2009 12:00 PM in response to paultahoe

Yep, I'm not liking it one bit. Here's a screen capture of Little Snitch doing its thing when a new message arrived. I hadn't even clicked on the message yet, and Mail is trying to connect to a host in the message.

http://farm3.static.flickr.com/2695/405007857705167b8055b.jpg

I definitely have 'Display remote images in HTML' unchecked, and the message shown in the screen grab had no attachments.

Dan

Reply

Answer 5

Nov 4, 2009 11:07 AM in response to Dan Rosenfeld

Well, from my googling, I've found that this is an issue that others are concerned about, too. I saw a post from a developer that said he can send an email to a mac user, and determine whether the user received it in OSX or on his iPhone. Apparently the iPhone does the same thing.

I've had the same email address for ages, and I have to try real hard to keep from drowning in spam. This situation effectively informs spam senders that my email address is a good one, that I read the message, and gives them my IP address and host information to boot!

Man, I hope there's a fix for this soon.

Reply

Answer 6

Nov 10, 2009 7:25 AM in response to Dan Rosenfeld

Ran the update to mail v4.2 last night. Still having this issue.

Reply

Answer 7

Nov 10, 2009 7:46 AM in response to Dan Rosenfeld

iknewsletter.com is not a spam server, so you're jumping the gun by labeling it as such. An email doesn't need to have an attachment to have an image, so the fact there is no attachment means absolutely nothing.

If you actually have some evidence that Mail is attempting to connect to actual spam servers, then you might have something to complain about. Until then, there's no reason to be upset or panic.

Reply

Answer 8

Nov 10, 2009 8:01 AM in response to Golden Shoes

Let me clarify. I actually subscribe to the IK newsletter, and I didn't mean to id them as a spam sender. My intent was to expose the fact that many emails cause Mail to connect to a remote server for something.

I'm not panicking, but I am a little upset. I get a message from Little Snitch about 50 times a day. My rule database is growing quickly.

I've only been using Mac Mail for a few months. I recently converted from Windows w/Outlook. Maybe this 'feature' of Mac Mail has been around for a long time, and folks are used to it.

I submitted a report to Apple a week ago. Since I'm new here, I don't know what, if anything, to expect from Apple.

Reply

Answer 9

Nov 10, 2009 8:19 AM in response to Dan Rosenfeld

I get a message from Little Snitch about 50 times a day. My rule database is growing quickly.

It should only be growing quickly if all the connections are different and you're choosing the "Forever" and "Any connection" options for the Little Snitch dialog box. Otherwise, those rules would only apply during the current session of Safari; as soon as you quit, they're gone.

Maybe this 'feature' of Mac Mail has been around for a long time, and folks are used to it.

I don't see that as a feature, and I certainly don't experience that at all, even on my 10.4.11 system. If anything, I'd say it's a bug. You could also go the extra route of blocking those particular servers in your "hosts" file, like this:

Open Terminal and copy/paste this line:

sudo /Applications/TextEdit.app/Contents/MacOS/TextEdit /etc/hosts

It should open up a text file behind Terminal. Go to the end of the file, press Enter or Return for a new line and paste this:

0.0.0.0 xxxxxx.xxxxxx.xxx (where xxx.xxx.xxx.xxx is www.iknewserver.com, for example)

You could also purchase Hostal for this purpose, which gives you a GUI instead of having to deal with Terminal.

Save, not Save As…, and quit both applications.

Since I'm new here, I don't know what, if anything, to expect from Apple.

Apple doesn't respond to bug reports or feature suggestions; They do read them all and use them to track problems and develop fixes for them.

Reply