Zippity Do Da

One of the dumbest email security measures that has become common practice is the attachment rename. This example illustrates a common policy I've seen implemented by many organizations:

"Large files need to be compressed using the utility called WinZip. Due to the large number of infected messages with ZIP attachments, all ZIP attachments will be blocked by our mail server. You need to rename the file extension for all your submissions so the files will get through our mail server. You also need to provide instructions on how to convert your modified file extensions back to their original format in the same message"

This is pure madness. If a file is infected, renaming it won't change that. The bigger issue is email clients that auto-execute attachments or stupid users who execute any attachment they receive. I suspect most people who will run any attachment they receive will also figure out how to rename a file and run it. Oh yeah, evil virus people, perhaps you should start naming your virus keylogger.piz.

Hey, here's another idea, why not have your email server automatically rename the the file extensions instead of blocking the emails? This is much easier than trying to explain to everyone inside and OUTSIDE your organization your forbidden extension list.

Dr. Evil says: Zip It!