opening e-mails safely

Hi,

I want to get more information on reading or opening suspicious e-mails. It does not do any good to just delete an e-mail if I want to find out how they are engineered.

So far I have had no problems, or at least I think so. I have all relevant patches, OE is configured to remove attachments, and the virii scanning software is always enabled.

If I want to look at the message content and headers, I right click the e-mail in question, click properties and then message source. Finally I expand the window to read the content.
Amazing, the crap that's in some of these. I know some HTML, and its interesting to see apparently meaningless words between the delimiters.
Occasionally I have saved an attachment, scanned it, and only then opened it.

Are these safe practices, and are there some tips. I haven't seen a forum specifically on handling techniques of e-mails here.

g8way2u

I would not open suspicious items on your main computer. You might have noticed that your AV and all OS patches come AFTER the event?

Get an old machine to do this sort of thing on. If your main machine's AV lets you download or open malware then it is not protecting you against that malware?

Convert the file into a .txt file and open it in a program editing utility such as notepad or vi

Do not use Word, or similar high level text editors, as they can launch executables.

Just because an attachment passes you scan does not mean that it is safe..............or there wouldn't be any viruses?

Do be careful ;)

:)
Thanks nihil,

I have a little networking set up so far, a Cisco 1600 and Cisco 2621 router, and a 2900 series
switch. When I'm practicing, I disconnect from the Internet. In the future I want to set up a seperate network, a blackhat and whitehat, completely isolated from all other boxes.
So in essence you suggest that if I want to look at some of the mal-code, I save it to a floppy or cd and then move it to the isolated box. Offcourse, the e-mail and attachment gets deleted from the main box and the media with the mal-code marked as such and stored safely away from other media.
Any suggestions on how to set up a safe lab environment?

g8way2u

Well:

1. Pick up a couple of old boxes, maybe three, (PIs/PIIs) whatever is free or cheap. Hint: ex-corporate desktops are great because you can stack them in the same footprint, also they don't look "cool" so they have little street value?

2. Have at least one as a "sheep dip".........a stand alone

3. The other two you can network, even if only with a null modem cable :D

4. Once you have had a look at the "subject" on the sheep dip, you can connect it to one or both of the others to test network awareness and so on.

Just don't do this near any of your "real equipment" :eek: ......OK you seem to have the idea, if you catch one........lift it carefully into your lab environment.

You will need to get yourself the usual compression/decompression tools like UPX.............and hex editor etc..........compilers and decompilers.

Just take it at your own pace, and learn as you go :)

Good luck

Thanx again,
14 months I knew nothing, and now it's just an amazing journey.
I'll be posting as I learn.

g8way2u

for nihil mainly

to confirm, .txt is NOT a virus carrier ?
got 3 today, AV took them, and left a message with the V details as a .txt. attached to the mails
I opened them with notepad to see this.

edit:
Norton AntiVirus removed the attachment: mp3music.pif.
The W32.Netsky.D@mm threat was detected in the attachment.

this was the message left, just wanted to confirm that .txt is the safe way to check ???

If you are suspicious of the contens of an email, I say telnet it.

1. Open up a command prompt
2. run: telnet mail.mymailserver.com 110
3. once it connects: user yourusername
3. after the user name is in: pass yourpassword
4. after that: list
5. Then find the message you want to view: retr 3 (replace 3 with the message number)

Now you can view the actual contents in plaintext without worrying about the attachment or embedded virus'

Yes,

At present, or to the best of my knowledge and experience, there is nothing that will autostart in a .txt file read with a simple program text editor such as notepad or vi.

Hey, how could they write them without shooting themselves in the foot?..got to be a program text editor ;)

Foxy........txt is what you write them in :D Your AV found .pif files but sent you details in .txt?

hmmm.......seems like Norton agree with me , I am obviously wrong?

YES Foxy .txt is still safe, but keep your eyes and ears open, as things do change

Cheers

I make NO apologies for double posting, as my last reply was to a direct question.

Pooh:

Quote:

---

If you are suspicious of the contens of an email, I say telnet it.

---

You then gave detailed instructions :rolleyes:

Quote:

---

1. Open up a command prompt

---

Quote:

---

2. run: telnet mail.mymailserver.com 110

---

Quote:

---

3. once it connects: user yourusername

---

Quote:

---

3. after the user name is in: pass yourpassword

---

Quote:

---

4. after that: list

---

Quote:

---

5. Then find the message you want to view: retr 3 (replace 3 with the message number)

---

Quote:

---

Now you can view the actual contents in plaintext without worrying about the attachment or embedded virus'

---

In the real world that does not happen old chap..........honest...errr have you read many of the posts here in the newbie section?

You are not WRONG....just inappropriate............."telnet it" ...when a lot of people I know couldn't even spell "trojan"

My point is that this is also a family forum, and we have a lot of guests?..that is way too over the top IMHO? By the way...........I downloaded about 1500 messages from a little attended mailserver of mine...I was just imagining doing what you suggested with them :) (OK 99% SPAM=delete immediately)

Horses for courses is what I say?

Anyone else care to comment?

Cheers

:)
Well, like a pack of wolves, now I'm in the thick of it. I do have an inkling of what Telnet is.
It is some kinda terminal emulator for which you need a client and server, like secureCRT.
Having a router setup, I am familiar with the command prompt and hyper terminal, but haven't had much opportunity to play with telnet, which can open some holes on your system in itself.
I'll eventually get to that with some help and lots of reading. I don't get a lot of spam, 2-5 a week, so for me its not that much of a hassle, but rather a new way to learn how to view an e-mail. Yes, a lot of it is still above my head, but that's sometime a good way to learn.
Jump in the pool and swim. I trust that all of you will take me by the hand and support my first steps, and in return I'll ask before I do something stupid. Then one day I'll be able to pass on my knowledge.
I have nothing to show yet, but for a bit of hot air. Anyway, I've started laying the bricks for a solid foundation, I can throw a lot of acronyms around and even know what most of them mean, but somebody told me, that I'm starting at the top and working my way backwards to the beginning. Kinda quirky.

But thanks for taking such an interest in a newbie question.
Would it be permissable to copy and paste the content of an e-mail, sans attachment,
in this forum and have someone explain what exactly is going on? How to interpret the header
and all the goofy stuff in the body.

g8way2u

Quote:

---

Originally posted here by nihil

Hey, how could they write them without shooting themselves in the foot?..got to be a program text editor ;)

Cheers

---

So, " them " are written exclusively just from windows and not on other platforms? I'm lost! ;)

Destructive code/scripts can be wrote in Perl ,right? Or are you not talking about viruses?

scanning an attachment does not mean its safe. Viruses are packed and changed to avoid detection. as nihil said upx is often used along with many other packers. identifing strings are changed and 'nulls' are removed and the file itself can be morphed before its packed sometimes using more than one packer. the longer one been around the more changes it could have gone threw in order to avoid detection.

after you find out what’s been used to compress it by checking the av sites, news groups and bbs's which is allot easier than trial and error decompress it and use "strings.exe" against it. this will output all of the ascii characters it contains. any coding in human readable language, mail and irc addresses etc. here you can see if it trys to download additional components and get them maually to determin exactly what you dealing with without actual execution.

as has been said this should be done on a "spare" machine because av needs to be turned off if you want to look at the unpacked files and many add-ins that are downloaded.

i agree with you it’s absolutely intriguing.

Quote:

---

Originally posted here by bluthund

So far I have had no problems, or at least I think so. I have all relevant patches, OE is configured to remove attachments, and the virii scanning software is always enabled.

---

Just a minor point here about OE.

OE does not in fact remove the attachments, it merely prevents you from looking at them if you check that item in the security options. The copy of the email saved on your PC still contains the attachment.

This can be useful as you can just move it to a new OE folder, say Virus.
Each folder is saved as xxx.dbx (e.g. Inbox.dbx). So you have just created a virus.dbx folder.
Then all you have to do is copy the virus.dbx file to a test PC, and experiment as much as you like. This is perfectly safe, because at no time has the attachment been extracted from the email, and therefore cannot possibly have been browsed, executed etc.

EDIT: Just clarifying my original point.

:)
Thanks, this is so nice, to be able to communicate with people about this!

So I copy/move the .dbx file and transfer the subject to the "sheep dip", as nihil said. I suppose that I'd need OE on that box as well. I just recently read up on how to save and restore OE folders. Nice how that little bit of info comes in handy now. Would I have to uncheck the box that prevents access to the attachment? No biggy, that's what hacking is for. I'll practice with some benign files.

BTW, (like a kid in a sandbox), I played with "ethereal" in class this evening, capturing a download of a web-page, finally understanding a process. LOL, it's like a 'first time' kinda thing, amazing. But seeing it in action, rather than just reading about TCP/IP....but then reading up on it first does help.

L8er

g8way2u

To belatedly answer your question.

Yes, you will need OE on your test box.

Keep the security option ticked on your main live box.
The dbx file will contain the attachment regardless of this setting.

Turn the security option off on your test box, and you will then be able to access the attachment.

:)

Many thankx,
it's time to go look for 'sheep-dip'.

g8way2u

Quote:

---

Originally posted here by bluthund
:)

Many thankx,
it's time to go look for 'sheep-dip'.

g8way2u

---

What is sheep-dip , a type of mushrooms? :eek:

:)

A reference to nihil's term for a box that holds mal-code, isolated from the real world.
I plan on setting up a lab environment, that allows me to analyze mal-code and see how it works, where it hides, how to remove it and how to protect against it.
This box would be named "sheep-dip", like you dip sheep in a solution that applies medication or chemicals.
A rather fitting name, don't you think? LOL

g8way2u

something that caught my eye ??
from Darkes: re: the DBX files in OE.
I (again) managed to trash my OE settings, have had to generate a new account, with a new SID ?? and as such I am unable to access the old files ?? which include some job references.

So, the question is 'could someone tell me how to access my old DBX files , preferably, so that I can re-fit ??? them into the NEW account.

Hi,

Quote:

---

So, " them " are written exclusively just from windows and not on other platforms? I'm lost!

---

No, that is not what I meant............anything not written in machine code uses some sort of higer (text-based) language. I did mention vi, for example, which is the *nix program text editor?

I have also used RPG II/III/400, which has its own text/program editor.

My point was simply that a programming language needs some sort of editor, and this is what you use to read/write/modify the code?

If you are looking at 4GLs, it is better to use its inbuilt editing tool, but the principle is the same?

Anyway, we are looking at object code here, not the source?

Cheers

:)
Hi foxyloxley,

make sure that your hidden files and file extensions are viewable.
You can access those functions from 'Folder Options' in My Computer.
Leave the My Computer window open....
Open OE, click Tools, then Options.
Click the Maintenance tab, then the Store Folder button.
You should see the path to the location of the stored .dbx files.
Right-click the path and click Select All.
Right-click the path again and click Copy.

Go back to My Computer and right-click in the Address bar and click paste.
Press Enter, which will take you to the location where these files are stored.
At this point you want to make sure that OE is closed, because backing up these
files with OE open may result in corrupt back-up files. So go back to OE and click
Cancel on the Store Folder dialog box, then click Cancel on the Options window.
Exit OE before proceeding.

Now you can copy the files you need. Don't move/delete them. You can back-up to
another folder, floppy or cd.

Once you have OE fixed, create a new folder and name it something distinctly different
than Inbox, Outbox, etc. Do this by right-clicking Local Folder in OE and choose New Folder.
Follow the above instructions to get to the location again, close OE and copy/move your
.dbx files into the new folder you created (Drag and drop works). You may want to create several new folders for the various categories. To keep it coherent, you could create an INcopy, OUTcopy, DELcopy, SENTcopy folder. If you copy a back-up folder into a folder that has some .dbx files in it, these will be overwritten, hence the need for new seperate folders.
You can move e-mails later, once you are in OE.
By creating a special folder for "bad" e-mails, you can use this technique to lift them onto an isolated box.
Let me know if this works for you.

g8way2u

Oops,

I'm not sure if this works when you loose the old SID, but it may be worth a try.

g8way2u

Quote:

---

Originally posted here by foxyloxley
something that caught my eye ??
from Darkes: re: the DBX files in OE.
I (again) managed to trash my OE settings, have had to generate a new account, with a new SID ?? and as such I am unable to access the old files ?? which include some job references.

So, the question is 'could someone tell me how to access my old DBX files , preferably, so that I can re-fit ??? them into the NEW account.

---

bluthund is quite correct, but there is another way of doing this.

It doesn't matter that your SID has changed.

Search for the directory in which your original dbx files exist (you'll need to search for hidden files), and copy it or make a note of the name, in particular the SID bit.

From your new install of OE, select File->Import->Messages. Assuming you are running OE6 (or OE5 !!), select the OE6 option, and the first option, and choose 'main identity'.
After you have hit next, change the SID in the directory name from your current one to your original one, and that should do the trick.

You can import messages from multiple previous copies of OE etc. using this method.
If you should have a problem then you can instead copy all the dbx files to a new folder, say oemails. Then do the same thing but select the OE store directory option instead, and point it to the new folder you have just created (C:\oemails in this case).

foxy try this www.tomsterdam.com
there's an app called dbextract which is the dog's b's when it comes to recovering dbx files which may have gone missing.

As a final comment on this, there is no need to use anything fancy to transfer a single dodgy email to a test box. Just set up a virus folder in OE on the test box, and copy the virus.dbx file from the live box to the appropriate directory on the test box (it will fit on a floppy!). If you want to make things easy, then change the ridiculously long directory name on the test box to something more meaningful.

The only reason I’m suggesting this approach is that firstly it is bullet proof, because the malware has not been installed on your live PC, and cannot have been accidentally used.

Secondly, you also have the text/HTML code of the original email to examine including header information, which is often of equal importance in trying to work out what the virus was up to, where it came from etc.