Internetworkers: http://www.ibiblio.org/internetworkers/

[Steven Champeon <schampeo AT hesketh.com>]

on Thu, Apr 08, 2004 at 02:16:18PM -0400, David Minton wrote:
> I have not seen any of them, though I have our mail server configured to
> reject any message with a .pif attachment (among others). I have never heard
> of a legitimate reason to send one of these files to someone, and I have yet
> to receive any complaints from users because of this. It was my
> understanding this was a common practice.

We have our servers set up to quarantine any message with an executable
attachment (based on an analysis of the actual body of the attachment,
looking for certain strings characteristic of Win32 exes) and reject
mail with a wide variety of attachment types. We also reject mail from
servers that HELO as a NetBIOS name, on principle, and that alone has
kept out most of the worst virus outbreaks. I can count on two hands
(and maybe one foot) the number of actual virus-infected messages we've
received since August (after the SoBig outbreak).

I've also toyed with rejecting ZIP files, as the latest round of viruses
seem to be using them more and more.

The fact that email isn't the best way to send files around notwithstanding,
it's a shame that these jerks are doing so much to ruin email as a medium.

What's far worse, though, is the folks who run servers that accept mail
from forged senders /and then bounce it back when it is found to be
undeliverable/, to the forged sender. Between joe job spam runs and
idiot antivirus filters, I now have a list of over 10K broken mail
servers from whom I no longer accept /any/ null-sender mail (used by
MAILER-DAEMON, et al.). We've got a customer who's been sent over 45K of
these 'accept-then-bounce', or "backscatter", messages since mid-March.

Please, if you're running a mail server that accepts undeliverable mail
and then bounces it back to forged senders, or that - perish the thought -
does that with the /infected file still attached/, as many anti-virus
servers do, even when they should know that the virus forges the sender,
go jump off a bridge. :) And leave someone competent in your place.

Thanks,
Steve

-- 
hesketh.com/inc. v: +1(919)834-2552 f: +1(919)834-2554 w: http://hesketh.com
Buy "Cascading Style Sheets: Separating Content from Presentation, 2/e" today!
http://www.amazon.com/exec/obidos/ASIN/159059231X/heskecominc-20/ref=nosim/