full-disclosure - Backdoor not recognized by Kaspersky

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <40472F4A.E89B263B@swift.com>
From: jimmy.kuijpers at swift.com (KUIJPERS Jimmy)
Subject: Backdoor not recognized by Kaspersky

Hehehe, encrypted is a big word. Especially for a zip file. The contents can most certainly be read. Also be email gateways and virusscanners. Passwords can be cracked. There are special tools that can extract the contact of a
password protected zip file without knowning the password. To cut is short, the information is "reshufled" or rather compressed but NOT encrypted at all!

I think eventrough e-mail is not intented as a file transfer utility. For the common people it is the only way they know how they can send some files to their friends and co-workers. So I do not think that we should block all
executables and compressed files by default.

Rather following the suggestion made to stop accepting mail from spoofed mail relays makes much more sense to me. If that solution is workable I think it could solve alot of problems related to spam.

my 2cts
Jimmy

"Aditya, ALD [Aditya Lalit Deshmukh]" wrote:

> > The zip's contents can
> > be seen without the password, just not unpacked...no cracking it required.
>
> now winrar has a option to encrypt file names with a password, me thinks pkzip with the 64 bit compression also has that feature... how are we going to deal with this ? by stopping all the compressed mail at the email gateway ?
>
> we do have one solutions: all the mail headers are spoofed so just stop accepting mail from spoofed host, this should solve your spam problem also
>
> > You should be blocking executables by policy anyway, yes?
>
> that is always being done by the all the people in this day and age, only now we seem to forget to add the compressed file format that are encrypted so that their file contects cannot be seen ?
>
> -aditya
>
> ________________________________________________________________________
> Delivered using the Free Personal Edition of Mailtraq (www.mailtraq.com)
>
> _______________________________________________
> Full-Disclosure - We believe in it.
> Charter: http://lists.netsys.com/full-disclosure-charter.html
-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/x-pkcs7-signature
Size: 1477 bytes
Desc: S/MIME Cryptographic Signature
Url : http://lists.grok.org.uk/pipermail/full-disclosure/attachments/20040304/1685cd23/smime.bin