Feeds

Trojan writers exploit Outlook Express to get around content filtering

Triple extension risk

  • alert
  • submit to reddit

5 things you didn’t know about cloud backup

Virus authors and Trojan writers are using fresh malware tricks to fool traditional content filtering packages, email security firm MessageLabs says.

A feature of Microsoft Outlook Express can be exploited to evade content filters and persuade an email recipient that an attachment is safe to open - even when it contains malicious code. Microsoft Outlook is not at risk (contrary to first reports of the problem).

How the New Exploit Works

The exploit relies on especially crafted email headers, creating an attachment with three file-extensions. Standard email packages will not generate these headers; these emails must either be created by hand, or using hacker tools (many of which are freely available, MessageLabs warns).

The first extension (e.g. .jpg) is visible to the email user, and is intended to persuade them that the attachment is "safe". The final extension (also, for example, .jpg) is used by Outlook Express to set the icon to represent the application for opening the attachment.

However, the unusual middle extension (.EXE) is used by Outlook Express to determine how to launch the attachment, therefore an .EXE file will be executed if a user double clicks on an infected attachment. Other examples may include .COM, .PIF, .SCR, or .VBS.

Clear and present danger

In the last week MessageLabs stopped more than 3,000 copies of a Trojan called Sadhound, which had been distributed using this trick. MessageLabs says it has stopped other emails containing this attack mechanism.

The company warns there are now many tools freely available to VX writers that can be used to assist them in fooling potential victims.

Many content filtering mechanisms block double extension attachments automatically.

But that doesn't necessarily happen with triple extensions, hence the risk that malware may get past content filters until virus signature updates are applied.

There is a workaround involving blocking file attachment with triple extensions or with very long filenames (another hallmark of the exploit) at email gateways.

Alex Shipp, a senior anti-virus technician at MessageLabs, advises admins to carefully check the rules of content filtering tools to see whether a rule blocking triple extensions can be added.

MessageLabs also advises end-users to be extra careful about opening attachments. In particular, users should check for the existence of the three dots in the filename that Outlook Express displays. ®

External Links

MessageLabs advisory

Next gen security for virtualised datacentres

Whitepapers

Implementing global e-invoicing with guaranteed legal certainty
Explaining the role local tax compliance plays in successful supply chain management and e-business and how leading global brands are addressing this.
Top 10 endpoint backup mistakes
Avoid the ten endpoint backup mistakes to ensure that your critical corporate data is protected and end user productivity is improved.
Top 8 considerations to enable and simplify mobility
In this whitepaper learn how to successfully add mobile capabilities simply and cost effectively.
Rethinking backup and recovery in the modern data center
Combining intelligence, operational analytics, and automation to enable efficient, data-driven IT organizations using the HP ABR approach.
Reg Reader Research: SaaS based Email and Office Productivity Tools
Read this Reg reader report which provides advice and guidance for SMBs towards the use of SaaS based email and Office productivity tools.