Full Disclosure mailing list archives
Re: Filtering sobig with postfix
From: Valdis.Kletnieks () vt edu
Date: Wed, 20 Aug 2003 09:16:34 -0400
On Wed, 20 Aug 2003 10:17:16 +0200, vogt () hansenet com said:
/see attached file for details/ REJECT ever since, I've not had a single one coming through.
The reason this one works for the worm writers is because it's standard English usage - as a result, it's *very* prone to false positives. And you give no indication of *why* the file was rejected, so the sender has no idea that if he re-sends but says "Hey check out the file for the long version" instead it will get through. If you're going to do this, scan for something that's almost certainly unique to the worm(s) you're fighting, and give the user a hint what the problem is....
Attachment:
_bin
Description:
Current thread:
- Filtering sobig with postfix vogt (Aug 20)
- Re: Filtering sobig with postfix martin f krafft (Aug 20)
- RE: Re: Filtering sobig with postfix Bojan Zdrnja (Aug 20)
- Re: Filtering sobig with postfix Valdis . Kletnieks (Aug 20)
- <Possible follow-ups>
- RE: Re: Filtering sobig with postfix Joshua Thomas (Aug 20)
- Re: Re: Filtering sobig with postfix securdz (Aug 21)
- RE: Re: Filtering sobig with postfix Bojan Zdrnja (Aug 21)
- RE: Re: Filtering sobig with postfix Joshua Thomas (Aug 21)
- RE: Re: Filtering sobig with postfix Paul Szabo (Aug 21)
- Re: Filtering sobig with postfix martin f krafft (Aug 20)