Stripping jpgs from email 1

[mmrsupport]

Greetings,

About a year ago I found something about jpgs having vulnerability to have viruses attached to them, this being one of them:

http://www.symantec.com/security_response/writeup.jsp?docid=2002-061310-4234-99&tabid=1

This one is listed as a very low threat. As time has passed, many people in the company have requested an email be added to our whitelist. That list has gotten way too big, and left us too vulnerable to other threats since I am unable to just whitelist them for jpgs.

Any comments/thoughts? I think I can be safe removed the .jpgs from our list of attachments. Here is the list of what we currently remove:

bat|cmd|com|cpl|dll|exe|hta|pif|scr|sys|vb|vbe|vbs|zip|mim|bhx|plf|b64|hqx|uu|uue|xxe|jpg

Any suggestions for additions is appreciated as well. Thanks.

 

[Diancecht]

Some mail clients have an option to let email pass in but not show images.

Cheers,
Dian

 

[kjv1611]

True - what Diancecht said.

For instance, in Microsoft Office Outlook 2003, the default option is to allow image files, but to not "open" them, so they come in but you can't see them. Then, you can simply tell it to "download images" when you are sure the sender/email is safe.

The options are located:

"Tools" menu
-->"Options"
---->"Security" tab
------>"Change Automatic Download Settings" button

 

[mmrsupport]

We have a mix of 2000 and 2003 Outlook clients. The 2003 clients by default block images, but I'm worried about the others. Is there that much of a risk with that file type?

 

[Diancecht]

To be sincere, I don't consider blockinh jpegs the way to go:

http://www.techweb.com/wire/security/47900743

Cheers,
Dian

 

[mmrsupport]

Thanks. This will reduce our exposure since I can remove many whitelist entries, and concentrate on more prevalent threats.

 

[pechenegs]

I think Mozilla Thunderbird e-mail client blocks images!

Member of ASAP Alliance of Security Analysis Professionals

under the name khazars