lists.openwall.net   lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  PHC 
Open Source and information security mailing list archives
 
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
From: purdy at tecman.com (Curt Purdy)
Subject: [inbox] Re: Re: E-Mail viruses

Ron DuFresne wrote:

> > 1. We use the Draconian technique of stripping all .exe
> .zip. ,gif .jpg
> > .scr .bat .pif files.


> Very draconian in todays world, and not productive by the way
> some folks
> do the work they have to do with limited capabilities these days.  It
> seems that we might was well revert back to only allowing
> e-mail in plain text

Ah, I wish...  An alternative is to allow only a proprietary extension
through, like .inc  Legitimate senders would rename the file, be it .exe
.doc .jpg, indicate in the body of the message what the true extension is,
and the receiver merely renames it.  A little trouble yes, but it virtually
eliminates email propagated viruses from the corporation.

Curt Purdy CISSP, GSEC, MCSE+I, CNE, CCDA
Information Security Engineer
DP Solutions

----------------------------------------

If you spend more on coffee than on IT security, you will be hacked.
What's more, you deserve to be hacked.
-- White House cybersecurity adviser Richard Clarke


Powered by blists - more mailing lists