Some of my coworkers use Microsoft Outlook (I believe) and have it configured in such a way that mail attachments are encapsulated in winmail.dat files. Apart from the general annoyance and lack of interoperability, I would like to know whether there are arguments against this. Has the concept of winmail.dat encapsulation been used by existing malware for their dissemination? Something masquerading as a winmail.dat container, or exploiting regular encapsulation in a winmail.dat? Or is the concept desperately secure/impossible to exploit?
2
-
I think you are confusing TNEF with the convention used for naming the files. Without some undersanding of the protocols involved, a discussion of the merits or defficiencies of various approaches is moot.– symcbeanCommented Feb 12, 2014 at 14:02
-
@symcbean : as I said, I'm interested in malware exploiting either (naming convention or encapsulation format).– EusebiusCommented Feb 12, 2014 at 14:45
Add a comment
|
1 Answer
Long answer: According to Microsoft, Winmail.dat is a file that keeps the rich-text formatting readable if sent by Outlook. I have sniffed around a bit and found out that attachments that 'act' like the way Winmail.dat does exist.
Then again, since it's an attachment (and I hope you don't auto-open attachments from emails), you should only open it if you trust the person that send it to you, or have a good anti-virus that can scan your mail too.
Short answer: yes, attachment malware called winmail.dat exists, exploitation of a valid file is possible, because it basically contains theming.
More info on winmail.dat can be found on this website: http://support.microsoft.com/kb/278061
