Subject: Re: [Asrg] Trust relationships etc.

From: [email-masked]
Date: Fri, 22 Jul 2005 19:33:58 +0000 (GMT)

>>[email-masked] wrote:
>
>  
>
>>This is another laugh... has anybody ever seen a legitimate, dangerous virus 
>>(the kind that antivirus software might catch, I mean) contained in a PLAIN 
>>ASCII TEXT E-mail?
>>    
>>

> I haven't seen one in a while, but back in the late 90s there were a few 
viruses that came as uuencoded files in a plain text e-mail.  Some 
examples are the Happy 99, Zacker (aka Maldal) and My Party viruses.  
You really cannot make any assumptions that only mime or html emails are 
potentially unsafe.

1)  Are such uuencoded viruses (in the absence of being indicated as encoded 
attachments) actually picked up by these antivirus programs?

2)  If the recipient software doesn't recognize them as an encoded attachment, 
and doesn't offer them enticingly as something for clueless users to click on, 
does it really matter very much?

Gordon Peterson                  http://personal.terabites.com/
1977-2002  Twenty-fifth anniversary year of Local Area Networking!
Support free and fair US elections!  http://stickers.defend-democracy.org
12/19/98: Partisan Republicans scornfully ignore the voters they "represent".
12/09/00: the date the Republican Party took down democracy in America.

_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: James Lick <[email-masked]>
Date: Sat, 23 Jul 2005 10:32:19 +0800

>attachments) actually picked up by these antivirus programs?

Not sure what you mean by 'these', but I know that ClamAV detects them.  
The ones I mentioned are part of the test samples for my clamassassin 
filter.

>does it really matter very much?

It is not as common as it once was, but there are mail readers which 
automatically decode uuencoded emails, with the user presented with a 
file icon they can click on.  Uuencoding was the main method of sending 
files by email before MIME got more popular.

While uuencoded attacks will probably not be viable enough in the 
current environment, your theory that plain text emails are 'safe' is 
just not true.  There's also the issue of malformed headers which have 
in the past have been able to exploit bugs in some software.  My point 
is that even plain text emails have risks associated with them.  ANY 
data you receive from the net could potentially be harmful.

-- 
James Lick -- 黎建溥 -- [email-masked] -- http://jameslick.com/