Re: blocking .ZIP attachments

["Jeffrey I. Schiller" <jis () MIT EDU>]

We permit .ZIP files, however we have been quite successful in
blocking all variants of myDoom, Bagle, et. al. with a simple check of
the ZIP file. We do this with our own filter (written in Python and
integrated into the sendmail binary). The algorithm is:

* If the first component of the ZIP file is between 20k and 40k and is
  stored instead of deflated.

* The first component (undeflated) is between 20k and 40k and is
  deflated, but the compressed size is greater then the uncompressed
  size.

These checks are reasonably fast, as all the needed information is in
the ZIP file header, no deflating is required. The checks are also
agnostic vis a vis encryption, the header is in the clear even in
encrypted ZIP files.

If people are interested, I can provide more information on our
system.

                        -Jeff

**********
Participation and subscription information for this EDUCAUSE Discussion Group discussion list can be found at 
http://www.educause.edu/cg/.

Attachment: _bin
Description: