45

If I send an email with an .exe attachment to an Outlook recipient, the email client blocks the attachment and the recipient has no way of overriding this security setting (short of making certain changes to the registry). If I send the same email to a Gmail recipient, the email is refused by the server.

Why are they being so strict? Is there a possibility that the attachment may execute automatically, or is it simply to protect naive users from explicitly executing an untrusted attachment? Would it not be sufficient to use a big, fat warning aka "Are you really sure you want to do this?"

Of course, I can upload my .exe file to a file sharing service and provide the link in the email. Why is this considered any more safe than an attachment? A malicious scammer may do the same thing.

EDIT: I ask this question partially to learn whether it is safe to turn the feature off (by modifying HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Outlook\Security\Level1Remove). I take it from the answers that this is safe for me personally, but probably not on the administrator level.

  • 26
    I can deny passing you a knife (exe file) if I think you are prone to stabbing yourself or others with it (which most users are) but I really have no way of stopping you from going out and getting your own knife. The former is fault of the administrator, the latter is fault of the user. If you have an actual need to be emailing executables then you are quite frankly "doing it wrong". – MonkeyZeus Jan 14 at 19:07
  • 4
    If I remember correctly, historically outlook used the IE to show emails, which was in principle the windows explorer. So passing along a bit of javascript code you could autorun an embedded .exe file. And since outlook (express) was automatically delivered since windows 95 you had a HUGE attack-surface, which was often used. The well-known "I love you" virus from 2000 built on this. Open the email in the quasi-standard outlook(express) on windows 95 / 98 and you had it infecting your system. It then automatically multiplied itself by sending a copy to everybody in your address book – eagle275 Jan 15 at 13:35
  • 8
    RE: Big fat warning: ... users don’t read anything. – Andrew Keeton Jan 15 at 14:34
  • 3
    Because if you don't block it, users will click it. – amalloy Jan 15 at 21:19
  • 3
    @Andrew Ah yes, the ol' file in a prison cake trick. – MonkeyZeus Jan 16 at 20:21
80

Would it not be sufficient to use a big, fat warning

Sure, if they worked. Most people tend to just "click away the annoying" without thinking.

Blocking executables means that attackers can't do something like sending totallylegitfile_really.pdf.exe It's a very basic social engineering defense to block executables.

Attackers have to go through the extra steps like you described, and so does the end user. Those extra steps give the user a little more time to think about whether this whole interaction makes sense. That extra time is key.

If I spoof the HR department's email (or make it look similar) and send out staff_bonuses.pdf.exe and it hits the user's inbox, there is little to protect the user. One click is all it takes. To do the same as an attacker, I would have to upload it somewhere then send the link. That's going to get more than a few people curious about why HR is using some 3rd party file hosting service.

It's a basic defensive measure. It raises the threshold of difficulty for attackers forces them to use 3rd party tools and gives end users a little more time to think.

  • 13
    "That's going to get more than a few people curious about why HR is using some 3rd party file hosting service." - not when they all do that because various peoples' email systems keep blocking their attachments. – user253751 Jan 14 at 14:01
  • 25
    @user253751 Why is HR sending executables? And why are the files not available internally to attach/link? – schroeder Jan 14 at 14:06
  • 14
    They're not sending executables, but the files they do send keep getting rejected by systems that block more file types than just executables. – user253751 Jan 14 at 14:37
  • 18
    @user253751 then you are talking about rules beyond the scope of the question and beyond my experience with any organisation. – schroeder Jan 14 at 22:03
  • 6
    @schroeder File size restrictions maybe? They're a good reason to use file hosting services instead of email attachments. – Bergi Jan 15 at 0:54
21

This is the good old cost/benefit ratio.

@schroeder's answer is about the gain, this one is about the cost

What is admitted by both Google and Microsoft is that end-users should never exchange executable files. Images or video files are end-user objects, as are office files. But when it comes to executables they should only come from a store.

Such a decision is certainly not developer-friendly, but developers are expected to be advanced enough to find a way to circumvent it, for example by using a relay HTTP site, or using advanced encoding. Said differently the cost is assumed to be negligible.

  • 7
    "using advanced encoding" Yup! Like changing the file extension to .txt. "Text" files never get purged. – Tezra Jan 14 at 19:02
  • 6
    @tezra Unsure for Gmail and Outlook (I use neither of them), but the security system included in my corporate mail server detects executable files whatever the extension, and even insiste zip archives... – Serge Ballesta Jan 15 at 4:22
  • 5
    "What is admitted by both Google and Microsoft is that end-users should never exchange executable files." Do you have sources of them saying this to back this up? – nick012000 Jan 15 at 4:59
  • 4
    @nick012000: I don't. But if they assumed that exchanging executable by mail was a natural operation they would not ban it. – Serge Ballesta Jan 15 at 6:32
  • 2
    @SergeBallesta they're probably checking for magic bytes, here's an example. – Ave Jan 15 at 17:38
18

Put bluntly Users are stupid

Not all of them, of course. But when you are handling the email for hundreds or even thousands of users, you will have some of those users that will open anything, provide their credentials on any phishing page (even those mimicking a different site!), etc.

Thus all kind of filters get added to mail systems for preventing that malicious content arrive to the users. They may include url reputation, antivirus filtering, and one of the most powerful ones is to simply block certain content.

When was the last time you needed to send an extension to Windows Control panel by email? Yes, a few people do develop them. The rest of the world receiving one it's just a virus. Even if it's not detected by your AV solution.

Similarly, in a comment Ismael Miguel mentions .iso files. What good is sending a .iso file by email? A typical iso file will be at least 500-600 MB. Some of your users would happily send them by email (even a 4 GB one), but that is an abuse of the system, email is not designed for file sharing, and does a relatively poor job at that. You should be looking at other solutions for file sharing (email is the lazy way, though).

The fact is that virus are using odd formats such as .iso, or old compression ones, precisely to overcome (Email) filters that would block their virus if they used a more common container (such as zip).

So, yes, it is simply to protect naive users from explicitly executing an untrusted attachment.

Would it not be sufficient to use a big, fat warning aka "Are you really sure you want to do this?"

Experience has showed that it is not.

Look at the interface of Microsoft Office when opening a document with macros. It will do exactly that, when opening a file downloaded from the internet / an email it will show a bar such as:

Be careful - email attachments can contain viruses. Unless you need to edit, it's safer to stay in Protected View.

(List of Protected View messages)

However, almost every malicious document will contain content instructing the user to disable the Protected view "in order to view the document". Actually, so that the malicious macros will run.

And the bad news is that -for a fraction of users- they work. Users are receiving malicious emails, opening the attached (or linked) documents infected with macros, disabling the Protected view "Sandbox" and getting infected. The recent Emotet infection waves mostly(?) used macro document. And people got infected. By loads.

It's not that it is a bad design. In fact, Microsoft engineers didn't have much choice than allowing the users to override it (note: the system administrator may enforce that they get blocked), as there are certain legitimate cases for sending and receiving documents with macros.

There are of course legitimate cases for receiving otherwise blocked attachments, including suspicious or even known-to-be malicious content. For instance, an abuse@ email address, should be able to receive a notice of the malicious url on their own infrastructure that is serving a trojan, or a sample of the email they are sending out rather than blocking it at reception like some systems do (the best practice would be to apply filters both on sending and receiving).

Thus, the filters could be configured to exempt certain senders / recipients / mailboxes that need to receive otherwise blocked attachments. A good setup may additionally ensure that they can only be accessed from certain systems (isolated from the network, maybe?) and/or by some users known not to be stupid. :-)

  • 4
    "Not all of them, of course" -> "All of them, of course." Everyone is an idiot some time or the other. – muru Jan 15 at 5:47
  • 3
    All users have moments of inattention. It's not fair to say that "Users are stupid". I know a CISO at a major bank who gets and processes 600 emails a day. He's more than an expert in security, has a PhD in cryptography from Cambridge and worked with the military in the field to hack hostile networks and devices. He will still click on phishing emails. Is he stupid? Absolutely not. He just can't always spend the extra few seconds of attention needed to assess all emails. Even experts need a safety net. – schroeder Jan 15 at 10:44
  • 1
    @schroeder: "Users are stupid" is just shorthand for "user's will do dangerous things they should never do". They don't really mean they're actually stupid. A better phrase is probably in order. And I believe you about the CISO, that click is almost automatic after you've seen enough emails. – James Reinstate Monica Polk Jan 15 at 13:02
  • 2
    @JamesReinstateMonicaPolk it's called "human factors" and it is multi-layered. I offer a better phrase: "Even experts need a safety net." – schroeder Jan 15 at 16:00
  • @schroeder Actually I would classify not spending the extra few seconds of attention needed to assess all emails as stupidity. – Andrew Jan 16 at 16:55
6

Email systems once used to allow to send executable files, but stopped doing that because it lead to the spread of lots of viruses. One key event in this regard was the "ILOVEYOU" email worm of 2000, which consisted of a malicious visual basic script which would delete various files and forward itself to all other email contacts of the user. Users had to execute it manually, but a surprising number of users did. So many that estimations for the worldwide damage caused by the worm go up to 8 billon dollar.

3

My cat has opened attachments by walking on the keyboard ( I guess Tab and the 10-keys' Enter are one stride apart); hosing a system shouldn't be so mindless.

1

Executable files should only be transported by a secure tamper-resistant medium. If emailing of executables were widespread, it would be fairly simple for a malicious actor who had control of an email server to make it insert viruses into executable files sent as attachments to mail that went through that server. Since neither the sender nor recipient of email generally has control over the path it takes, there would be no way of knowing whether any particular message would reach its destination without being infected.

  • 2
    In modern times, are emails ever relayed through a server that is not controlled by either the sender or the recipient or their respective email providers? – user253751 Jan 16 at 10:59
0

Another reason is making it more difficult to use email as a coordinated channel in an attack.

If an attacker eg succeeds in compromising a PC into scripting a limited set of user actions or overlaying misleading images onto application programs (to make users do something else than they think they are doing), the very last thing you want to facilitate is supplying executable files to such attacks - this would turn a limited attack into an effectively unlimited attack.

Granted, such an attack could also utilize a web browser accessing a prepared web server as a channel - however, for a web browser downloading large and/or executable files is routinely a needed function, and web browser designers will have to deal with making their software more resilient against such abuse anyway - and in a very security conscious environment, web access might already be well policed against such incidents.

-3

The main reason is to protect users from hacking. For those messages that may spread viruses, like messages that include executable files or certain links. Sometime it also depend on IP address if it is blacklisted.