Email Security Testing Zone Powered Up With New Exploits
by Berislav Kucan - Tuesday, 28 October 2003.
About two years ago, GFI launched the Email Security Testing Zone - a web site that enables organizations to check whether their email systems are vulnerable to email viruses and attacks. Since then, GFI did several updates to the zone, every time adding new security tests. Recently, even more exploits were added, making the total count of 17 working tests.

Recent addtions include:

Long subject attachment checking bypass test [for Outlook Express 6 and Outlook 2000] - This test checks whether an email system accepts emails with long subjects; in some versions of Outlook and Outlook Express, long subjects can be used to bypass attachment checking.

Attachment with no filename vulnerability test - This test examines whether an email system accepts executable code that can bypass content checking security solutions. Because this attachment has no filename, the executable code it contains will not be detected by most content checking software, and the code can be executed using Outlook.

Long filename vulnerability test - Attachments with long filenames can be used to trick a user into double-clicking an attachment, thereby executing the malicious code it contains on the system: as the long filename is truncated by the email client, the attachment can be made to look like an innocent file (for example, a JPG image file). This test indicates whether a system can block emails that use this exploit.

Popup Object Exploit vulnerability test - The Popup Object Exploit automatically launches files on the vulnerable system, so a secure email system should not accept emails that contain this exploit.

Double file extension vulnerability test - This test checks whether your email system accepts emails which contain attachments with double file extensions, for example mypicture.jpg.hta. The actual file extension for this attachment would be HTA (HTML application), which is executable code. However, this exploit may trick users into thinking that this is a harmless JPG image file.

You can test your e-mail system security by visiting GFI's Email Security Testing Zone at: http://www.gfi.com/emailsecuritytest


Image 1.1: Example of a successful Email Security Testing Zone exploit

Spotlight

How to talk infosec with kids

Posted on 17 September 2014.  |  It's never too early to talk infosec with kids: you simply need the right story. In fact, as cyber professionals itís our duty to teach ALL the kids in our life about technology. If we are to make an impact, we must remember that children needed to be taught about technology on their terms.


Weekly newsletter

Reading our newsletter every Monday will keep you up-to-date with security news.
  



Daily digest

Receive a daily digest of the latest security news.
  

DON'T
MISS

Fri, Sep 19th
    COPYRIGHT 1998-2014 BY HELP NET SECURITY.   // READ OUR PRIVACY POLICY // ABOUT US // ADVERTISE //