Re: suggestions for blocking dangerous mail attachments?

On Sat, 11 Jan 2003, Juan Mejia wrote:

> Here are my questions:
>
> What's your opinion about changing file extensions on windows
> machines to reduce the threat of malware through e-mail?

The only way to make something foolproof is to keep it away from the fools. You know it will be just a matter of time 'til someone renames the attachment to .exe, runs it and you have a virus on the loose.

>
> Do you know of some application that does this on linux?

All flavours of Linux will include procmail, which is a mail sorting program that will do what others have suggested. I am currently using it for my home network to scan all emails coming in. It now searches for known_virus (the ones that we have trapped, confirmed that it is a virus and written a definitive "recipe" to catch any others). It also traps any messages that contain attachments which we deem are unacceptable. These messages are quarantined until we determine that they are safe and then can be released, but only I have the authority to release them. Later on, when you get tired of all the spam that you get, you can use the same program to easily filter 95% of the junk mail so it doesn't get to your users.

The upside of all of this is that you can customize it to the exact way you want it to operate. The challenge is that you will have to learn alot along the way.

My $.02

Good luck in whatever you choose
Dan

• Registered Linux user: 244008 * "Free speech is the right to yell
• * 'theater' in a crowded fire"
• Powered by Slackware 8.0 *

  ---

Do you need help?

In addition to our free technical library, Pantek provides professional IT services to companies who utilize Open Source software: Learn more about Pantek's Technical Support offerings Place an order for 24/7/365 Technical Support here Learn more about Pantek, who we are, and what we do Chat with a Live Operator Related securityfocus.com Links bugtraq certification focus-bsd focus-ids focus-ih focus-linux focus-ms focus-sun focus-unix-other focus-virus forensics incidents libnet linux-secnews ms-secnews pen-test secpapers secprog sectools secureshell security-basics securityjobs sf-news vuln-dev webappsec Request more information about Pantek