Re: Bypassing quarantine with ADS formatted filenames

["Naren" <naren () pactech net>]

u need to get application aware gateways, which look at the application, not
the extension.

Then, this can be stopped. There are few in the market.

Naren
Singapore
----- Original Message ----- 
From: "Jack Cullen" <jack_cullen () hotmail com>
To: <security-basics () securityfocus com>
Sent: Friday, June 04, 2004 11:46 PM
Subject: Bypassing quarantine with ADS formatted filenames


> Is it possible to get file attachments past AV software by using alternate
> data stream type filenames?
> We have set McAfee GroupShield to quarantine all .zip files yet several
> people have received messages with .zip attachments that came in the
> following formats:
>
> The attachment 'Informations.zip:Informations.txt'
> -or-
> The attachment 'sample01.zip:data.rtf
>                                     .scr'
>
> _________________________________________________________________
> Get fast, reliable Internet access with MSN 9 Dial-up - now 3 months FREE!
> http://join.msn.click-url.com/go/onm00200361ave/direct/01/
>
>
> --------------------------------------------------------------------------
-
> Ethical Hacking at the InfoSec Institute. Mention this ad and get $545 off
> any course! All of our class sizes are guaranteed to be 10 students or
less
> to facilitate one-on-one interaction with one of our expert instructors.
> Attend a course taught by an expert instructor with years of in-the-field
> pen testing experience in our state of the art hacking lab. Master the
skills
> of an Ethical Hacker to better assess the security of your organization.
> Visit us at:
> http://www.infosecinstitute.com/courses/ethical_hacking_training.html
> --------------------------------------------------------------------------
--
>

Attachment: InterScan_Disclaimer.txt
Description:

---------------------------------------------------------------------------
Ethical Hacking at the InfoSec Institute. Mention this ad and get $545 off 
any course! All of our class sizes are guaranteed to be 10 students or less 
to facilitate one-on-one interaction with one of our expert instructors. 
Attend a course taught by an expert instructor with years of in-the-field 
pen testing experience in our state of the art hacking lab. Master the skills 
of an Ethical Hacker to better assess the security of your organization. 
Visit us at: 
http://www.infosecinstitute.com/courses/ethical_hacking_training.html
----------------------------------------------------------------------------