RE: [Full-Disclosure] Backdoor not recognized by Kaspersky

["Aditya, ALD [Aditya Lalit Deshmukh]" <aditya.deshmukh@xxxxxxxxxxxxxxxxxxxxxxxxxxxxx>]

> The zip's contents can
> be seen without the password, just not unpacked...no cracking it required.

now winrar has a option to encrypt file names with a password, me thinks pkzip 
with the 64 bit compression also has that feature... how are we going to deal 
with this ? by stopping all the compressed mail at the email gateway ?

we do have one solutions: all the mail headers are spoofed so just stop 
accepting mail from spoofed host, this should solve your spam problem also

> You should be blocking executables by policy anyway, yes?

that is always being done by the all the people in this day and age, only now 
we seem to forget to add the compressed file format that are encrypted so that 
their file contects cannot be seen ?

-aditya 




________________________________________________________________________
Delivered using the Free Personal Edition of Mailtraq (www.mailtraq.com)

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html