I'm fan of split design for web browsing for security reasons - trusted web sites can be accessed via http proxy from pc clients, the rest of web sites via some remote desktop technology from specific servers only residing in dmz.

I'm not sure how to make some good preventive design for mail, especially to be protected against malicious attachments (no, antivirus is not enough). Today a pdf can contain code which while the pdf is printed can hack a printer for example.

What are example designs for some secure mail handling?

Do exist some good documents about this topic?

  • Do you have any links to a PDF that hacks a printer? Commented Feb 6, 2013 at 14:52
  • How about investing is a secure PDF reader instead of adobe? Commented Feb 6, 2013 at 15:05
  • @BrianAdkins Actually, Adobe Reader X brought some pretty decent improvements in the sandboxing engine and various heap protection mechanisms. They put a hell of a lot of work into it. I'll be the first to agree that Adobe Reader has, historically, been horribly vulnerable, but the newer versions do seem to be holding up pretty well.
    – Polynomial
    Commented Feb 6, 2013 at 17:50
  • @Polynomial : That is definitely good news. But a simple reader that has no scripting functionality at all should be intrinsically safer due to fewer attack vectors. Commented Feb 6, 2013 at 20:05
  • @BrianAdkins I can't say I've exhaustively researched it, but I'm pretty sure that most Adobe Reader exploits have not been through scripting, but rather through bugs with the rendering engine and other internal libraries. For example, SVG rendering bugs were common when support was introduced.
    – Polynomial
    Commented Feb 6, 2013 at 20:31

3 Answers 3


Scanning is really the best and only option. You have to grant access to the message in some way shape or form. For any situation you can propose to access the information, a sufficiently advanced attacker could bypass it. You could try viewing the message in a virtual machine, but the attacker could include a virus capable of bypassing the hypervisor. I suppose you could be guaranteed security if you downloaded each message to a fresh computer, disconnected from the Internet, read the message and then nuked the computer from orbit before reading the next message, but this is likely a tad bit excessive. Short of that, scanning for issues prior to opening it is the best option, possibly using a VM environment to do so as a second level of protection if you really feel it necessary.

The most practical advise is never open anything from an unknown or unexpected sender... ever.

  • Right now I'm thinking to rip all attachments from untrusted domains and replace them with info msg that they are saved for later inspection. The access to the files would be only via a server (remote desktop) in dmz.
    – jirib
    Commented Feb 6, 2013 at 14:30
  • I'm also thinking to split mails totally. Mails from untrusted domains would be delivered to different mailbox, each user would have 2 mailboxes, one accessible from user's pc, other from restricted computer.
    – jirib
    Commented Feb 6, 2013 at 14:32
  • Don't forget about the security triangle, blog.rootshell.be/wp-content/uploads/2010/08/…. But you might be onto something @JiriXichtkniha, you could sandbox email access to a web ui only, but there is no perfect solution, we will always be playing whackamole with the malware writers. Even if you sandboxed their email access, what good does that do when ultimately the users want to open the file on their own machine?
    – MDMoore313
    Commented Feb 6, 2013 at 17:46

You could force an automatic translation of "suspicious files" like PDF: in sandbox (e.g. a virtual machine), you run Ghostscript to convert the PDF into PCL; then, in another VM, you use GhostPDL to rebuild a PDF file. The resulting PDF will (hopefully) result in the same graphical contents (displayed or printed) but Javascript or other advanced content will have been stripped. This should make the PDF files "safe" as long as PCL is not "upgraded" to support scripting.

Since this will break some PDF files (trouble can be expected with fonts, notably) and will remove the spiffy features of PDF (e.g. notes attached to the file, or form fields), users will hate you for that, and look for alternate ways to propagate the actual PDF files despite your filters (e.g. rename them as .txt, encode them in Base64 copy-pasted into the email body, convey the file with Dropbox, simply switch to http://mail.google.com/...). Once you have turned your users into active enemies, security is lost forever. So don't do that.

  • It's my understanding though that the firmware embedded inside the PDF is hex, so if this firmware was in unicode range how would that rid the PDF of the printer firmware? It seems like it would just treat it as merely text from the PDF.
    – MDMoore313
    Commented Feb 6, 2013 at 15:44
  • 2
    @MDMoore313 modern printers process data in software just like any other computer, specially crafted data might be able to subvert the software just like any other exploit.
    – lynks
    Commented Feb 6, 2013 at 15:58

Mailscanner is a good way. don't know if it catches everything but it will filter all the mail coming into your environment, and can also give a daily report as to if anything was filtered (mail flagged as possible spam is quarantined and not delivered to a user's inbox), and give the user the option of releasing the mail. It will block attachments as well, although I'm not 100% sure how good it will be at detecting printer firmware inside PDFs......

  • Thanks but as I said, i do not trust any 'it can do everything' software/appliance, so that's why I prefer some split design because I already presuppose the application/appliance won't catch everything (and then you are not surprised).
    – jirib
    Commented Feb 6, 2013 at 12:48

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .