A way to defeat e-mail virus filtering

In mid-September, SecuriTeam issued a warning about a simple technique that could potentially defeat antivirus systems using nothing more than Microsoft Outlook Express.

SecuriTeam, a group within Israel's Beyond Security, provides information and tools to help deal with computer security threats. The group provides a wealth of useful information regarding security holes in various products and protocols, as well as advice on making systems more secure.

Outlook Express, Outlook 2000 (in Internet mode) and several other e-mail clients have a very useful and user-configurable feature that will split a large message into two or more smaller messages. This is done so that large messages can be sent more efficiently over low-speed connections, or so that large messages can bypass ISP-imposed message size limits. The segmentation of the message is transparent to the sender, as is the reassembly of the message by the recipient's client.

While this feature is potentially very useful, it does have a downside: If a message contains a virus, that virus might be able to slip through gateway-, server- or desktop-based virus scanners undetected. This is because the virus also is split up into smaller parts along with the message and so may not be recognized by the scanner. Once the message is reassembled on the client's computer it could then execute. This feature could also potentially be used to defeat other types of content-scanning systems, such as spam- or pornography-filtering systems.

Fortunately, many of the leading vendors of virus- and other content-filtering systems are aware of this problem and have developed various solutions. Included among these vendors are Symantec, Trend Micro and McAfee, although some vendors' solutions may require that users download a patch or update.

Information on this security threat is available at:

www.securiteam.com/securitynews/5YP0A0K8CM.html

Michael D. Osterman is the principal of Osterman Research, a market research firm that helps organizations understand the markets for messaging, directory and related products and services. He can be reached by clicking here.

Messaging archive
Past newsletters.