uuencoding
Results 1 to 7 of 7

Thread: uuencoding

  1. #1
    Senior Member
    Join Date
    Nov 2001
    Posts
    4,786

    uuencoding

    i uuencoded an exe and put the ascii code in a web page then logged on to a computer that cannot download exes. got the web page fine. copied the code and was able to convert it.

    how can i prevent this from happening
    Bukhari:V3B48N826 “The Prophet said, ‘Isn’t the witness of a woman equal to half of that of a man?’ The women said, ‘Yes.’ He said, ‘This is because of the deficiency of a woman’s mind.’”

  2. #2
    Senior Member
    Join Date
    Oct 2001
    Posts
    748
    Two ways.

    1) Prevent access to IE. Although this is probably more extreme than you are looking for. However, as the uuencoded text, it that, just text. There is no way to tell IE not to look at uuencoded material. Mainly because IE doesn't know what the text is.

    2) Prevent the user from running any kind of program that would convert the UUencoded content back to an EXE. Unfortunately right now, there is no 100% method to do this. There is talk that in the next version of windows you will be able to create a signature of an Exe, and then block that signature from running. This gets around just renaming blocked files. However, you could go through the OS and setup the directory structures and file permissions so that there is no way the user can get the uuencode program onto the system. This would however, prevent the user from running anything that you did not specifically allow them to run, and would take a lot of work to setup.

  3. #3
    Senior Member
    Join Date
    Nov 2001
    Posts
    4,786
    im sorry ! im behind a watchguard fire wall. i was hoping there was a setting to prevent this. It hasn't been a problem and probably wont be. but on the off chance that it might...

    we have a pretty open policy. i'd like to keep it that way and winzip is essential for daily biz.
    Bukhari:V3B48N826 “The Prophet said, ‘Isn’t the witness of a woman equal to half of that of a man?’ The women said, ‘Yes.’ He said, ‘This is because of the deficiency of a woman’s mind.’”

  4. #4
    Senior Member
    Join Date
    Mar 2003
    Posts
    452
    If it's a company computer you are trying to protect, you can lock the machine down to the point where no one can install any programs to decode the text, such as disabling base64 or uudecode. Another thing you might want to do, is disable access to binary files that you haven't approved, and especially the command prompt, that's a killer right there.

    There's really no way to disable text on a webpage, other than to filter the pages that are allowed to be surfed. If you have a proxy setup at work, then limit access to only autorized websites. Remember the first rule of security would be to deny all access to everything and allow access to only what you specifically grant permission to do. So, your employees should not be surfing any webpages that you haven't specifically given access to.


    --PuRe
    Like this post? Visit PuRe\'s Information Technology Community. We\'ve also got some kick ass Technology Forums. Shop for books and dvds on LiveWebShop.com

  5. #5
    Senior Member
    Join Date
    Jan 2002
    Posts
    1,207
    How about:

    Run a trusted computing system whereby all exe files need to be authorised before being allowed to run. So the user may be able to be decode the exe file, just can't run it.

    True, this does break down when you realise that every Excel or Word doc is technically an exe file...

    Slarty

  6. #6
    Senior Member
    Join Date
    Nov 2001
    Posts
    4,786
    unfortunatly winzip has the capacity to decode it. All machines have winzip. locking computers down is out of the question so i guess ill just have to watch closely.
    Bukhari:V3B48N826 “The Prophet said, ‘Isn’t the witness of a woman equal to half of that of a man?’ The women said, ‘Yes.’ He said, ‘This is because of the deficiency of a woman’s mind.’”

  7. #7
    AO Ancient: Team Leader
    Join Date
    Oct 2002
    Posts
    5,197
    Tedob: I don't know your environment but the first question I would ask myself is:-

    Do my users have the imagination, technical know-how and do I have anything here that would make them need to do this risking what should be dismissal for a policy breach, (Thou shalt not install any software without the prior permission of you MIS), to make them want to go through this?

    If you can answer positively to any one of the three then you have a problem because I don't know of any way to block uuencoding on Watchguard Firebox or Firebox II - Mime types yeah - not uuencode.

    I have found that there are cases where there simply isn't a technical solution for what is, after all, an administrative problem without the benefit being outweighed by the cost.
    Don\'t SYN us.... We\'ll SYN you.....
    \"A nation that draws too broad a difference between its scholars and its warriors will have its thinking done by cowards, and its fighting done by fools.\" - Thucydides

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •