Hi Scott,
In the case of all text file types (BAT, CMD, etc), the actually file type
would just be text. EXE, COM, ZIP, SCR (variant on EXE), etc. are mainly
what I'm talking about.
By detecting the file type instead of just the extension, and allowing
configurable actions based on detected filetype, we could avoid future
viruses that ask the user to rename the file upon receipt.
This, couple with the existing BANEXT functionality, would allow us really
tighten security for what we allow through.
So perhaps something like the following
BANTYPE EXE
BANTYPE ZIP
These would catch exe and zip files regardless of whether they were named
.exe, .ex_, .frank, .joe, etc. (No offense to anyone named Frank or Joe
intended...<grin>)
This still leaves the security hole you identified with the text file types
like .bat, .cmd, .vbs, etc., but perhaps we'll be able to think of a decent
way to identify them better as well.
Thoughts?
Darin.
----- Original Message -----
From: "R. Scott Perry" <[EMAIL PROTECTED]>
To: <[EMAIL PROTECTED]>
Sent: Friday, March 05, 2004 10:15 AM
Subject: Re: [Declude.Virus] Bagle.J / news.com article on AV software
opening zipped files.
>That is exactly why I suggested scanning for file types instead of
>extension. I think Scott mentioned that they need to include full MIME
>decoding before something like that would be possible.
>
>Scott, how feasible is this idea for inclusion?
I'm not sure exactly what the idea is. Some of the ideas suggested are
already available (such as scanning all attachments, regardless of
extension).
For Declude Virus, there is no issue of MIME decoding -- Declude Virus
complete "MIME decodes" each E-mail.
We can attempt to determine the file type without looking at the extension,
and should be able to accurately detect most .EXEs, and all .ZIP
files. But it would still not be possible to accurately detect batch
files, scripts, etc. (without a huge amount of resources being used to
create the test and use it). However, if we *do* do that (as was the case
with 1.78i7 and .ZIP files, where it would detect them regardless of
extension), it poses a problem: Most people right now want to be able to
send .ZIP files. There would need to be many options set up to implement
something like this.
-Scott
---
Declude JunkMail: The advanced anti-spam solution for IMail mailservers
since 2000.
Declude Virus: Catches known viruses and is the leader in mailserver
vulnerability detection.
Find out what you've been missing: Ask for a free 30-day evaluation.
---
[This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]
---
This E-mail came from the Declude.Virus mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.Virus". The archives can be found
at http://www.mail-archive.com.
_____________________________________
[This E-mail virus scanned by 4C Web]
---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.Virus mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.Virus". The archives can be found
at http://www.mail-archive.com.
