<html>
<head>
<meta content="text/html; charset=ISO-8859-1"
http-equiv="Content-Type">
</head>
<body text="#000000" bgcolor="#FFFFFF">
<br>
<div class="moz-cite-prefix">On 24/06/2014 19:43, Ryan Stepalavich
wrote:<br>
</div>
<blockquote
cite="mid:E1C9564D86400B4DBE488FD058C170F60E4509D9@SVREXCH01.banksi.com"
type="cite">
<meta http-equiv="Content-Type" content="text/html;
charset=ISO-8859-1">
<meta name="Generator" content="Microsoft Word 14 (filtered
medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Consolas;
panose-1:2 11 6 9 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri","sans-serif";}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
span.EmailStyle17
{mso-style-type:personal-compose;
font-family:"Calibri","sans-serif";
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-family:"Calibri","sans-serif";}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
<div class="WordSection1">
<p class="MsoNormal"><span
style="font-size:12.0pt;color:#222222;background:white">Hi
folks,</span><span style="font-size:12.0pt"><o:p></o:p></span></p>
<p class="MsoNormal"><span
style="font-size:12.0pt;color:#222222"><o:p> </o:p></span></p>
<p class="MsoNormal"><span
style="font-size:12.0pt;color:#222222">We just got hit with
two audit findings for ZendTo, and I was wondering if there
was any fix/workaround for these.</span></p>
</div>
</blockquote>
Interesting.<br>
<blockquote
cite="mid:E1C9564D86400B4DBE488FD058C170F60E4509D9@SVREXCH01.banksi.com"
type="cite">
<div class="WordSection1">
<p class="MsoNormal"><span
style="font-size:12.0pt;color:#222222"><o:p></o:p></span></p>
<p class="MsoNormal"><span
style="font-size:12.0pt;color:#222222"><o:p> </o:p></span></p>
<p class="MsoNormal"><span
style="font-size:12.0pt;color:#222222">#1: ZendTo allows any
file of any extension to be dropped off. Is there a way to
whitelist a few extensions and reject all others?</span></p>
</div>
</blockquote>
I learnt right back near the start of developing MailScanner that
basing security on filename extensions is a complete red herring and
a total waste of time. If you do any check at all, it *has* to be
based on file *content*, not file *name*. I intentionally did not
build this sort of a system into ZendTo as I wanted it to be a
solution for all those sites using MailScanner (or any other mail
security gateway product) where you have a need to get files in and
out that your mail system will not allow. If you restrict filename
extension, everyone (including the bad guys) just changes the
extension or adds a "safe" one with a simple note to the user to
rename the file once they've got it. It provides no security
whatsoever, it is a "tick box" and nothing more.<br>
<blockquote
cite="mid:E1C9564D86400B4DBE488FD058C170F60E4509D9@SVREXCH01.banksi.com"
type="cite">
<div class="WordSection1">
<p class="MsoNormal"><span
style="font-size:12.0pt;color:#222222"><o:p></o:p></span></p>
<p class="MsoNormal"><span
style="font-size:12.0pt;color:#222222"><o:p> </o:p></span></p>
<p class="MsoNormal"><span
style="font-size:12.0pt;color:#222222">#2: ZendTo's error
reporting allows attackers to enumerate your organization's
userlist. By brute-forcing the "To:" field in a drop-off,
the attacker can get the full list of valid users in LDAP.</span></p>
</div>
</blockquote>
Can you explain in more detail please? ZendTo does not verify the
contents of the "To:" field (other than the domain name in external
dropoffs). It's far easier and faster to enumerate all valid users
by brute-forcing SMTP "RCPT" commands. They usually give you an
instant valid/invalid response for each attempt, and don't require
you to attempt to send any message to anyone. Again, no added
security whatsoever, it's another tick box.<br>
<br>
Cheers,<br>
Jules.<br>
<br>
<blockquote
cite="mid:E1C9564D86400B4DBE488FD058C170F60E4509D9@SVREXCH01.banksi.com"
type="cite">
<div class="WordSection1">
<p class="MsoNormal"><span
style="font-size:12.0pt;color:#222222"><o:p></o:p></span></p>
<p class="MsoNormal"><span
style="font-size:12.0pt;color:#222222"><o:p> </o:p></span></p>
<p class="MsoNormal"><span
style="font-size:12.0pt;color:#222222">I can give further
details as needed.<o:p></o:p></span></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Best regards,<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Ryan Stepalavich, CSSA<o:p></o:p></p>
<p class="MsoNormal">Sr. Network Administrator<o:p></o:p></p>
<p class="MsoNormal">Savings Institute Bank & Trust, Co.<o:p></o:p></p>
<p class="MsoNormal">Office: (860) 465-8602<o:p></o:p></p>
<p class="MsoNormal">Fax: (860) 456-5218<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<pre>This document and any files transmitted with it are
confidential and intended solely for the use of the individual
or entity to whom they are addressed. If you have received this
document in error please notify the originator of the message.
Any views expressed in this message are those of the individual
sender, except where the sender specifies and with authority,
states them to be the views of Savings Institute Bank & Trust.
This footer confirms that this e-mail message has been scanned
for the presence of computer viruses by the Savings Institute
email gateway.
</pre>
<br>
<fieldset class="mimeAttachmentHeader"></fieldset>
<br>
<pre wrap="">_______________________________________________
ZendTo mailing list
<a class="moz-txt-link-abbreviated" href="mailto:ZendTo@zend.to">ZendTo@zend.to</a>
<a class="moz-txt-link-freetext" href="http://mailman.ecs.soton.ac.uk/mailman/listinfo/zendto">http://mailman.ecs.soton.ac.uk/mailman/listinfo/zendto</a></pre>
<br>
<pre class="moz-signature" cols="72">Jules
--
Julian Field MEng MBCS CITP CEng
'It's very unlikely indeed he will ever recover consciousness, and
if he does it won't be the Julian you knew.'
- A hospital consultant I proved very wrong in 2007 :-)
<a class="moz-txt-link-abbreviated" href="http://www.Zend.To">www.Zend.To</a>
Twitter: @JulesFM
PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654
</pre>
</blockquote>
</body>
</html>