full-disclosure - Re: [MailServer Notification]To recipient: Message matched eManager setting and action was taken.

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <43B53CAD.5975.2E238CA4@nick.virus-l.demon.co.uk>
Date: Fri Dec 30 00:57:13 2005
From: nick at virus-l.demon.co.uk (Nick FitzGerald)
Subject: Re: [MailServer Notification]To recipient:
	Message matched eManager setting and action was taken.

Valdis.Kletnieks@...edu to Michael Holstein:

> > ignoring the magic bits in the header. The next round of "social 
> > engineering" emails that say :
> > 
> > "rename the attached .fix file to .exe so you can run it correctly"
> > 
> > are just around the corner.
> 
> I believe this has already been spotted in the wild...

Huh???

Someone has not been keeping up with their reading...

It has been known for quite some time now that, depending on the 
flavour of Windows you run, simply renaming various kinds of files 
(including MZ/PE .EXEs and OLE2s) to unregistered extensions leaves 
them totally "executable" or "openable" _as usual with the normal 
extension_.

And yes, I believe that this has been exploited in mass-mailing and 
spam-seeded malware instances.

Regards,

Nick FitzGerald