Re[2]: Multiple Vendor Unusual MIME Encoding Content Filter Bypass

Dear Tomasz Kojm,

TK> That's extremely irresponsible to disclose bugs without giving the vendors
TK> any chance to fix them and prepare new software releases.

This is a rare case I can not agree with such statement.

Ability to bypass content filter is not a bug before this issues is
used in-the-wild, like ability to write undetectable virus is not a bug
in antivirus. It may be simply impossible to find all vendors and wait
for all fixes.

Ability to bypass content filter is a common case, especially for
"passive" filters not changing message content. It arises from the fact
different client applications and different content filters use
different algorithms. It's possible to create message with "fork": if
you make one assumption you miss attachment for Microsoft, if another -
you miss attachment for Mozilla. It's simply impossible to find malware
for all possible clients without normalization of the message. Message
normalization may, in it's turn, break digital signatures.

This problems and known methods of bypassing are discussed here:
http://www.security.nnov.ru/advisories/content.asp

I regularly update this whitepaper with newly discovered methods.
Please report if you know any content filtering bypassing method I
missed.

–Thursday, December 7, 2006, 5:15:50 PM, you wrote to [email protected]:

>> Several e-mail virus scanners can be tricked into passing an EICAR
>> test file if the following conditions are met:
>>
>> 1. the EICAR file is encoded in Base64 including characters not in the
>> standard alphabet (e.g. whitespaces) and
>> 2. the part containing the EICAR file is nested within one or several
>> levels of multipart/mixed content.
>>
>> Details and PoC can be found at:
>> http://www.quantenblog.net/security/virus-scanner-bypass

TK> That's extremely irresponsible to disclose bugs without giving the vendors
TK> any chance to fix them and prepare new software releases.

–
~/ZARAZA
Патриотизм - это та же религия. (Твен)