The Annoyance Filter.pdf - Fourmilab

§166 ANNOYANCE-FILTER MAIL FOLDER 139
166. Certain versions of Microsoft Outlook contain a horrific bug where Outlook decides whether an
attachment is executable based on its “Content−Type” declaration, but then actually decides whether
to execute it based on its “file type” (the extension on the file name, for example “.EXE”). Predictably,
mail worm programs exploit this by tagging their payload as an innocuous file type such as an audio or
image file, but with an executable extension.
The static method tests an attachment’s name against a list of vulnerable extensions. If it matches,
this is almost certainly a worm, which we should filter through the byte stream parser rather than
process normally. This will crack out the strings embedded in the worm, which will help us to fingerprint
subsequent worms of the same type.
The list of vulnerable extensions was compiled empirically from examining mail worms collected over
a three year period. I do not know if the list is exhaustive; Microsoft vulnerability experts aware of any
I omitted are encouraged to let me know about them.
〈 Class implementations 11 〉 +≡
bool mailFolder ::isSpoofedExecutableFileExtension (const string &s)
{
string sc = s;
}
stringCanonicalise (sc);
if ((sc.length ( ) > 4) ∧ (sc[sc.length ( ) − 4] ≡ ’.’)) {
string ext = sc.substr (sc.length ( ) − 3);
stringCanonicalise (ext );
return ((ext ≡ "exe") ∨ (ext ≡ "bat") ∨ (ext ≡ "scr") ∨ (ext ≡ "lnk") ∨ (ext ≡ "pif") ∨ (ext ≡
"com"));
}
return false ;
167. Calculate the size in bytes of the message transcript if written to a monolithic file with
lineOverhead bytes (by default 1) per line.
〈 Class implementations 11 〉 +≡
unsigned int mailFolder ::sizeMessageTranscript (const unsigned int lineOverhead ) const
{
assert(tlist ≠ Λ);
}
unsigned int n = tlist ⃗ size ( ), totsize = 0;
if ((n > 1) ∧ (tlist ⃗ back ( ).substr (0, (sizeof messageSentinel ) − 1) ≡ messageSentinel )) {
n−−;
}
list〈string〉::iterator p = tlist ⃗ begin ( );
for (unsigned int i = 0; i < n; i++) {
totsize += p ⃗ length ( ) + lineOverhead ;
p++;
}
return totsize ;