RE: Bypassing quarantine with ADS formatted filenames

["Ross, George" <george.ross () atlahq org>]

I agree with Naren.  It's important to do a tier approach to virus
detection as well. 

-----Original Message-----
From: Naren [mailto:naren () pactech net] 
Sent: Saturday, June 05, 2004 11:59 PM
To: Jack Cullen; security-basics () securityfocus com
Subject: Re: Bypassing quarantine with ADS formatted filenames


u need to get application aware gateways, which look at the application,
not the extension.

Then, this can be stopped. There are few in the market.

Naren
Singapore
----- Original Message ----- 
From: "Jack Cullen" <jack_cullen () hotmail com>
To: <security-basics () securityfocus com>
Sent: Friday, June 04, 2004 11:46 PM
Subject: Bypassing quarantine with ADS formatted filenames


> Is it possible to get file attachments past AV software by using 
> alternate data stream type filenames? We have set McAfee GroupShield 
> to quarantine all .zip files yet several people have received messages

> with .zip attachments that came in the following formats:
>
> The attachment 'Informations.zip:Informations.txt'
> -or-
> The attachment 'sample01.zip:data.rtf
>                                     .scr'
>
> _________________________________________________________________
> Get fast, reliable Internet access with MSN 9 Dial-up - now 3 months 
> FREE! http://join.msn.click-url.com/go/onm00200361ave/direct/01/
>
>
> ----------------------------------------------------------------------
> ----
-
> Ethical Hacking at the InfoSec Institute. Mention this ad and get $545

> off any course! All of our class sizes are guaranteed to be 10 
> students or
less
> to facilitate one-on-one interaction with one of our expert 
> instructors. Attend a course taught by an expert instructor with years

> of in-the-field pen testing experience in our state of the art hacking

> lab. Master the
skills
> of an Ethical Hacker to better assess the security of your 
> organization. Visit us at: 
> http://www.infosecinstitute.com/courses/ethical_hacking_training.html
> ----------------------------------------------------------------------
> ----
--
>


---------------------------------------------------------------------------
Ethical Hacking at the InfoSec Institute. Mention this ad and get $545 off
any course! All of our class sizes are guaranteed to be 10 students or less
to facilitate one-on-one interaction with one of our expert instructors.
Attend a course taught by an expert instructor with years of in-the-field
pen testing experience in our state of the art hacking lab. Master the skills
of an Ethical Hacker to better assess the security of your organization.
Visit us at:
http://www.infosecinstitute.com/courses/ethical_hacking_training.html
----------------------------------------------------------------------------