1

Outlook 2010 and antispam systems already forbid executable attachments.

In this scenario, does putting attachments with two dots in quarentine increase security? Attackers used to use this technique in order to make users believe they open an image when they are opening an executable.

Example: "cute-kittens.gif.exe" and "kernel-update.tar.gz"

  • You mean blocking "cute-kittens.gif.exe" and "kernel-update.tar.gz"? – mgjk Jun 1 '16 at 11:22
  • @mgjk Yes. Edited and added as an example. – Eloy Roldán Paredes Jun 1 '16 at 11:24
  • 1
    I don't see how blocking 2 dot files could increase security more than searching for the extension after the last dot. Blocking mimetypes could be more efficient(like, blocking application/x-javascript for example)... My 0,02$ – user28177 Jun 1 '16 at 16:50
  • i don't see how the name of a file, specifically the number of dots, has much to do with it's safety... – dandavis Jun 1 '16 at 17:38
  • @dandavis Attackers used to hide real extensions at the end of filenames. In order to deceive users used to put multiple extensions .jpg.exe. For example, Windows may hide last extension hoping that the user only see the first extension and not the last thus the threat. – Eloy Roldán Paredes Jun 2 '16 at 6:38
2

Yes, but there is a difference. While "cute-kittens.gif.exe" can raise some eyebrows, since a GIF shouldn't be executable, I wouldn't say the same about .tar.gz files. To be more clear, .tar.gz should be considered as dangerous as .zip.

In fact, since any compressed archive coming from a Unix-like system is usually .tar.gz, a .tar.gz file could have a reasonable justification, such as a compressed archive of pictures, whereas I don't think a .gif.exe could be justified in any way. Much in the same way, a .txt.gz file could simply be a compressed text file, and should not be viewed as suspicious just because of its extension.

It is true that compressed archives (even .zip, .rar,etc.) can be used in order to complicate the AV scanning process, for example by sending a password-protected archive or by deploying a zip bomb, so putting in quarantine compressed files may be a good idea. However, this doesn't depend on the "double dot" extension, but simply on the fact that they are compressed files.

TL;DR Files with extension ".X.exe", where X is docx, pdf, gif, jpg,etc. should always be blocked. Compressed archives having extension.tar.gz extension are no more dangerous than a zip archive. If Outlook only quarantines .tar.gz files, as opposed to zip, rar, and so on, this is wrong.

  • It is not possible from an usability point of view to block all compressed files, so I'm not going to block tar.gz explicitely. In fact, blocking tar.gz files seems to be an argument to NOT block 2 dots files. Blocking 2 dots files only have sense to protect against .X.exe, .X.com, .X.bat, etc but .exe, .com and. bat files and similar are already blocked so I think that blocking 2 dots files DO NOT INCREASE SECURITY. Hoping to read other opinions. – Eloy Roldán Paredes Jun 1 '16 at 17:16

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.