About two years ago, GFI launched the Email Security Testing Zone - a web site that enables organizations to check whether their email systems are vulnerable to email viruses and attacks. Since then, GFI did several updates to the zone, every time adding new security tests. Recently, even more exploits were added, making the total count of 17 working tests.

Recent addtions include:

Long subject attachment checking bypass test [for Outlook Express 6 and Outlook 2000] - This test checks whether an email system accepts emails with long subjects; in some versions of Outlook and Outlook Express, long subjects can be used to bypass attachment checking.

Attachment with no filename vulnerability test - This test examines whether an email system accepts executable code that can bypass content checking security solutions. Because this attachment has no filename, the executable code it contains will not be detected by most content checking software, and the code can be executed using Outlook.

Long filename vulnerability test - Attachments with long filenames can be used to trick a user into double-clicking an attachment, thereby executing the malicious code it contains on the system: as the long filename is truncated by the email client, the attachment can be made to look like an innocent file (for example, a JPG image file). This test indicates whether a system can block emails that use this exploit.


Popup Object Exploit vulnerability test - The Popup Object Exploit automatically launches files on the vulnerable system, so a secure email system should not accept emails that contain this exploit.

Double file extension vulnerability test - This test checks whether your email system accepts emails which contain attachments with double file extensions, for example mypicture.jpg.hta. The actual file extension for this attachment would be HTA (HTML application), which is executable code. However, this exploit may trick users into thinking that this is a harmless JPG image file.

You can test your e-mail system security by visiting GFI's Email Security Testing Zone at: http://www.gfi.com/emailsecuritytest


Image 1.1: Example of a successful Email Security Testing Zone exploit