Re: disguised .exe files

On Wed, 23 Mar 2011 16:46:41 +0100
Tomas Charvat <[email protected]> wrote:

> Did you i got right, that you are trying to detect renamed extension by 
> its extension ? ummm...  sounds like mission impossible to me.

I am not reinventing the wheel.

from qmail-scanner home page:

	windows executable attachments that aren't marked as being of MIME
	type "application/....." are blocked (e.g. renaming notepade.exe
	to notepade.gif and sending it as a GIF attachment would be
	quarantined, as Qmail-Scanner would realise it's an executable
	pretending to be something else).

Hmmm. That lead to another question.
What if I rename notepad.exe to notepad.txt and attached it as an
"application/octet-stream" and 

.exe    SIZE=-1 EXE files not allowed per Company security policy

is on quarantine-events??? 

What should QS do?? Block it or deliver it?

In my setup, it is delivering it and IMHO it shouldn´t.

Regards

Ethy

------------------------------------------------------------------------------
Enable your software for Intel(R) Active Management Technology to meet the
growing manageability and security demands of your customers. Businesses
are taking advantage of Intel(R) vPro (TM) technology - will your software 
be a part of the solution? Download the Intel(R) Manageability Checker 
today! http://p.sf.net/sfu/intel-dev2devmar
_______________________________________________
Qmail-scanner-general mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/qmail-scanner-general