lists.openwall.net   lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  linux-cve-announce  PHC 
Open Source and information security mailing list archives
 
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Message-ID: <200403060433.i264XFP308350@milan.maths.usyd.edu.au>
From: psz at maths.usyd.edu.au (Paul Szabo)
Subject: Re: E-Mail viruses

Curt Purdy <purdy@...man.com> wrote:

> ... dropping all non-priority [not named .dps] attachments ...
> If anyone gets ugly who happens to know the priority extension,
> the AV gateway will get it anyway.

Will get it, maybe, as well as until now. Maybe, because some (broken) AV
refuse to look at "randomly named" (e.g. non-EXE) attachments. As well, or
as badly, as until now, because AV does not "get" malware not yet in its
database; it never gets the new viruses, only the "boring old" ones.

Your arrangement may offer some protection from the deluge of common
viruses (allowing bits of each message through, instead of dropping them
altogether: still annoying to your users). However, it does not increase
your security (in the sense that you are still vulnerable to directed
attacks). Since your arrangement protects against some attacks, and does
not decrease security, it may be useful in some environments.

Cheers,

Paul Szabo - psz@...hs.usyd.edu.au  http://www.maths.usyd.edu.au:8000/u/psz/
School of Mathematics and Statistics  University of Sydney   2006  Australia


Powered by blists - more mailing lists