Re: Re: [Security] ZIP file attachments temporarily blocked on CalMail

From: Tessa Michaels <tessam_at_uclink.berkeley.edu>
Date: Wed Mar 03 2004 - 09:33:07 PST
Hello Richard:

I understand the need to temporarily block zipfiles for the greater good. However, I do want to weigh in that I use zip files a fair amount to avoid having download individual docs, and I had asked our units to submit budget pieces for my review in zip file format. I want to mention as well that the zip program will read tarfiles .. as I understand there would be no need to block those, this is another approach that I can use in the meantime. Please confirm. 

Thanks,
Tessa

Tessa Michaels
Chief Technology Officer
Business and Administrative Services
University of California, Berkeley
Tel: 510.642.5441


At 01:02 AM 3/3/2004, Richard A. Peters wrote:
Our intention is to disallow zip files only until we have a more refined detection method installed.  We recognize the importance of being able to transmit zipped files, and are working to resolve this restriction.

We currently do not have a sane way of notifying either the sender or recipient about virus deletions.  Modern e-mail worms are quite aggressive in the volume of mail they send, so any notification process would have to keep a history of prior notifications to prevent senders/recipients from finding hundreds of notification e-mails in their mailboxes. That capability does not exist currently.

..Richard Peters
  Central Computing Services

At 11:13 PM -0800 3/2/04, ken lindahl wrote:
At 03:45 PM 3/2/2004, Tom Holub wrote:
I would vote for completely dropping the messages.  People are confused
enough about this whole virus problem, and there's very little legitimate
reason to send .zip attachments.

i've received quite a few completely legitimate .zip files containing
documents sent by colleagues. there's nothing illegitimate about .zip
files per se.

i can understand the desire to drop .zip attachments temporarily while
the current virus is so prevalent, but i do think the recipient should
be noitified. an even better solution would be to not deliver the at-
tachment, cache it somewhere, and send the recipient a notification so
that s/he could fetch it, if s/he knows it to be safe (perhaps after
checking with the sender). i believe one of the other UC campuses has
a system like that, though i can't recall which campus.

ken


On Tue, Mar 02, 2004 at 03:26:29PM -0800, John Ives wrote:
 Wouldn't it be safer to just drop the attachments with a message (like
 the current deleted because of virus message), that way if something
 legitimate is sent, the recipient at least knows what happened and why.

 John


 On Tue, 2 Mar 2004, Aron Roberts wrote:

 >    Messages containing ZIP file attachments will soon be blocked on
 > the CalMail email system, at least temporarily.
 >
 >    From what I understand, messages with virus-containing attachments
 > purporting to come from "The Berkeley.edu Team" and support@socrates,
 > and using various techniques of social engineering -- such as telling
 > users that important instructions are included in these attachments,
 > or warning users that their accounts will be deactivated unless they
 > open these attachments -- have started appearing.
 >
 >    This situation is being investigated, and as an interim protective
 > measure, messages containing ZIP files will temporarily be blocked.
 >
 > Aron Roberts
 > Workstation Software Support Group
 > (for the CalMail team)
 > -------------------------------------
 > Sent via the ucb-security mailing list.
 >

 ------------------------------------------------------------------------
 The following was automatically added to this message by the list server:

 For information about Micronet, including subscribing to
 or unsubscribing from its mailing list and finding out
 about upcoming meetings, please visit the Micronet Web site:
 <http://micronet.berkeley.edu/>.

--
Tom Holub (tom_holub@LS.Berkeley.EDU, 510-642-9069)
College of Letters & Science
249 Campbell Hall

-
------------------------------------------------------------------------ The following was automatically added to this message by the list server: For information about Micronet, including subscribing to or unsubscribing from its mailing list and finding out about upcoming meetings, please visit the Micronet Web site: . Received on Wed Mar 3 09:34:08 2004

This archive was generated by hypermail 2.1.8 : Wed Mar 03 2004 - 09:34:08 PST