Home page logo
/

fulldisclosure logo Full Disclosure mailing list archives

RE: [inbox] Re: Re: E-Mail viruses
From: "Curt Purdy" <purdy () tecman com>
Date: Fri, 5 Mar 2004 14:20:18 -0600

Valdis.Kletnieks wrote:

Ah, I wish...  An alternative is to allow only a
proprietary extension
through, like .inc  Legitimate senders would rename the
file, be it .exe
.doc .jpg, indicate in the body of the message what the
true extension is,
and the receiver merely renames it.

So let's see.. the same bozos who read the text part of the
virus, get the password, and
use that to unzip the rest of the virus won't read the text
part, get the rename to do,
and.....

Color me dubious....

Methinks you misunderstand.  Only the proprietary extension, i.e. .inc or
.xyz or .whatever, would be allowed through, and since virus writers would
never use this extension, it would eliminate ALL viruses at the gateway.
The nice thing about this approach is that it completely eliminates the need
for any anti-virus on the mail server since all virus attachments are
automatically dropped without the need for scanning.  Quite a simple, yet
elegant solution, if I do say so myself.

Curt Purdy CISSP, GSEC, MCSE+I, CNE, CCDA
Information Security Engineer
DP Solutions

----------------------------------------

If you spend more on coffee than on IT security, you will be hacked.
What's more, you deserve to be hacked.
-- White House cybersecurity adviser Richard Clarke

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html


  By Date           By Thread  

Current thread:
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]