RE: 543.rar attachment

[<adisegna () siscocorp com>]

Sean, I have to disagree with you. Any file that that can encapsulate an
executable file should be blocked (IMO). ZIP files are one of the
biggest carriers of malicious content these days. I don't make it a
habbit of trusting my users no matter how many times they get trained.
RAR extraction tools are not part of the software image policy on my
network so users are oblivious to the file blocking. What is your
solution?

Thanks

 
AD
Information Technology Group
Security Identification Systems Corporation
 

-----Original Message-----
From: Sean Crawford [mailto:sean01 () accnet com au] 
Sent: Tuesday, March 08, 2005 9:39 PM
To: security-basics () securityfocus com
Subject: RE: 543.rar attachment



---> -----Original Message-----
---> From: adisegna () siscocorp com [mailto:adisegna () siscocorp com]

---> Subject: RE: 543.rar attachment


---> I just recently got the same executable inside .rar. I extracted
the
---> dddd.exe and ran a scan on it. Norton Corporate 9.01 didn't find
---> anything (as of 4 days ago). I wasn't about to double click this
exe on
---> my corporate network. Block the rar extension on your mail server.
--->

rar is a valid compression format...blocking it isn't a very good
solution.

2 cents.

Sean