From mboxrd@z Thu Jan  1 00:00:00 1970
Message-ID: <3eada45e676ee17692412646f4b9e4b1@plan9.bell-labs.com>
Subject: Re: [9fans] upas+scanmail question
From: presotto@plan9.bell-labs.com
To: 9fans@cse.psu.edu
MIME-Version: 1.0
Content-Type: text/plain; charset="US-ASCII"
Content-Transfer-Encoding: 7bit
Date: Wed, 13 Mar 2002 10:23:53 -0500
Topicbox-Message-UUID: 669cd310-eaca-11e9-9e20-41e7f4b1d025

By the way, the /bin/upas/vf in the qmail.in from my last message is
just a filter that wraps any attachments that could conceivably be
executable in a second header and tacks .suspect onto any
filename in the header.  For example:

	--NextPart_Webmail_9m3u9jl4l_16870_1015946096
	Content-Type: multipart/mixed;
		boundary="upas-uivwmswboqpteailkqnhbmxmyb"
	Content-Disposition: inline

	This is a multi-part message in MIME format.
	--upas-uivwmswboqpteailkqnhbmxmyb
	Content-Disposition: inline
	Content-Type: text/plain; charset="US-ASCII"
	Content-Transfer-Encoding: 7bit

	The following attachment had content that we can't
	prove to be harmless.  To avoid possible automatic
	execution, we changed the content headers.
	The original header was:

		Content-Type: application/msword; name="MM66.doc"
		Content-Transfer-Encoding: base64
	--upas-uivwmswboqpteailkqnhbmxmyb
	Content-Type: application/octet-stream
	Content-Disposition: attachment; filename="MM66.doc.suspect"
	Content-Transfer-Encoding: base64

We forward a lot of mail read by internal microsoft systems and we
don't want to be the vector for viruses.  With this extra goo,
they at least have to save away the attachment with a different
name and then execute it by hand.  It's less likely that they'll
do that without thinking since its a pain.  Just clicking on a
.exe attachment it too darned easy.

We don't look for the actual signature of known viruses, its too
hard to stay ahead of the viruses without a full time person
keeping track.  However, if someone wants, it would be a reasonable
thing to do.