Trojan writers exploit Outlook Express

[instronics]

I thought this might interest outlook users.

Trojan writers exploit Outlook Express to get around content filtering

By John Leyden, The Register Feb 3 2003 7:06AM

Virus authors and Trojan writers are using fresh malware tricks to fool traditional content filtering packages, email security firm MessageLabs says.

A feature of Microsoft Outlook Express can be exploited to evade content filters and persuade an email recipient that an attachment is safe to open - even when it contains malicious code. Microsoft Outlook is not at risk (contrary to first reports of the problem).

How the New Exploit Works

The exploit relies on especially crafted email headers, creating an attachment with three file-extensions. Standard email packages will not generate these headers; these emails must either be created by hand, or using hacker tools (many of which are freely available, MessageLabs warns).

The first extension (e.g. .jpg) is visible to the email user, and is intended to persuade them that the attachment is "safe". The final extension (also, for example, .jpg) is used by Outlook Express to set the icon to represent the application for opening the attachment.

However, the unusual middle extension (.EXE) is used by Outlook Express to determine how to launch the attachment, therefore an .EXE file will be executed if a user double clicks on an infected attachment. Other examples may include .COM, .PIF, .SCR, or .VBS.

Clear and present danger

In the last week MessageLabs stopped more than 3,000 copies of a Trojan called Sadhound, which had been distributed using this trick. MessageLabs says it has stopped other emails containing this attack mechanism.

The company warns there are now many tools freely available to VX writers that can be used to assist them in fooling potential victims.

Many content filtering mechanisms block double extension attachments automatically.

But that doesn't necessarily happen with triple extensions, hence the risk that malware may get past content filters until virus signature updates are applied.

There is a workaround involving blocking file attachment with triple extensions or with very long filenames (another hallmark of the exploit) at email gateways.

Alex Shipp, a senior anti-virus technician at MessageLabs, advises admins to carefully check the rules of content filtering tools to see whether a rule blocking triple extensions can be added.

MessageLabs also advises end-users to be extra careful about opening attachments. In particular, users should check for the existence of the three dots in the filename that Outlook Express displays. ®

This story was brought to you by Security-Focus

Enjoy

[gore]

wow, this almost never happens! im so shocked that outlook has a trojan =O (shocked face)
man this has become almost what people talk about around the dinner table, does anyone remember the thingy Microsoft had on there page about how eudora may not be designed to spread viruses like outlook>? that right there was a warning sign lol anyway man good article, its good to know theres yet another brick in the wall lol, Hey! Microsoft!, Quit leavin them scripts kids alone!! (i love pink floyd)