3 ms·
Open an attachment? Help! What the heck is meant by that? For all these years, I never clearly understood just what was meant by open an attachment. I don't
by graycat 12y ago
Open an attachment? Help! What the
heck is meant by that?
For all these years, I never clearly understood
just what was meant by open an attachment.
I don't have a clear description, definition,
or explanation. Help! [No joke]
Background.
In about 1995, I was using some OS/2 e-mail program
that wanted to put an icon somewhere for each
e-mail message, screamed bloody murder at all
those absurd icons
until my
throat was sore, got out the e-mail RFCs, and
in about an hour used the TCP/IP interface of the
scripting language Rexx to write my own POP3
e-mail software.
Did all the e-mail reading and writing in just
my favorite text editor, KEdit.
The pair worked great -- used them for years.
Then, sure, just as in the e-mail RFCs,
especially about multi-media internet
mail extensions (MIME) or some such,
there were attachments. So, again in
Rexx, I wrote the basic base 64 en/decode software
to handle attachments.
So,
of course, I could receive a virus via e-mail
totally safely -- to me, an attachment was just
some simple ASCII characters to be interpreted
as the base 64 encoding of something, maybe
a JPG file. No harm in receiving the ASCII
characters -- they look like just
gibberish of simple typing by a very
busy kitty cat walking on a keyboard, no harm in that --
or the base 64 code or translating
that base 64 code to bytes and storing
the bytes in a disk file. A file is just
a sequence of bytes, any bytes at all --
harmless.
Simple. Save.
So, if an attachment claimed that it was a JPG,
then I might give the corresponding file
from translation from base 64
to some graphic software to
display the JPG. If in fact the attachment
was an EXE to do harm to my computer data, etc.,
then I would trust the graphics program to notice
that the attachment was not a JPG -- should be
easy enough for the graphics program
to tell.
Then I moved to Windows XP and then SP3 and
Outlook 2003, and I'm still there and see
little or no reason to change but just want to
get on with my real work where XP SP3 is fine.
So, Outlook has attachments. Still, I never
knew just what the heck was meant by open
an attachment. So, if an attachment, say,
in some MIME
e-mail header line or some such, claims
that it is a JPG file, then maybe give the
attachment, translated from base 64, to some
graphics program and trust that the graphics
program will (1) display a real JPG
without harm or (2) give an error message
at anything else. Similarly for PNG, GIF,
BMP, HTML, CSS, JS, etc.
For an EXE, of course, certainly, no way would
Windows let the thing try to execute as software,
right? I mean, not a chance, true? Or, the old,
rock solid, first rule of computer security was
to never, but never permit data from an untrusted
source to execute as software, right? Handle
such data just as bytes, sure, okay, safe, etc.,
but just no way ever let it execute as software,
and that should be okay, right?
So, what does open do that is not safe?
No joke: In all these years, I've heard
about e-mail and open an attachment
and still have no clear description,
definition, or explanation that would
say just what open does or why it's
dangerous.
As far as I can tell, the people, maybe
who wrote Outlook 2003, who talked about
doing an open on an e-mail attachment
never really made at all clear just what
the heck they were talking about.
Since many people still are afraid of
open, where I see little chance of
harm, maybe others would like some
clarity, too.
Help! [no joke].
- TeMPOraL 12y agoOpen in case of attachment means the same it means in case of anything else in the system - take the data and give it to some program to handle. Attachments, be it EXEs or DOCs or whatever, exist as bytes in memory but don't (at least, they shouldn't) get processed - that is, opened - until you explicitly ask to.
- 72deluxe 12y agoAs you correctly state, the attachment is just a bunch of base64 encoded text with a file type specifier in MIME. "Opening" an attachment involves bundling it off to the shell for the shell to handle that file type. So, JPEGs get handled by the JPEG shell handler. DOCs get handled by the DOC shell handler. And unfortunately EXEs get handled by the EXE shell handler. This breaks the rule that you stated, that you should never ever permit data from an untrusted source to execute. This is where the problem lies! As far as "open" means, it is a piece of terminology to explain the concept of saving data to a temporary store and then passing that file reference to the shell, which typically for most programs gets passed as a parameter to that file-type-handling program. Explorer > Tools > Folder Options will list file types in there and you can see how different types are handled, and the parameters passed to programs. Of course, the base64 encoding, temporary file saving, shell passing is a bit more complex to explain to someone than using the expression "open", hence why people just say "open the attachment". It's a terminology thing.
- graycat 12y agoYes, at least in the media, there is a lot of confusion about how e-mail and 'open' work. E.g., for https://news.ycombinator.com/item?id=9050436 https://news.ycombinator.com/item?id=9050436 about http://www.nytimes.com/2015/02/15/world/bank-hackers-steal-millions-via-malware.html http://www.nytimes.com/2015/02/15/world/bank-hackers-steal-m... in that NYT piece on hacking banks in Russia there is: "In many ways, this hack began like any other. The cybercriminals sent their victims infected emails — a news clip or message that appeared to come from a colleague — as bait. When the bank employees clicked on the email, they inadvertently downloaded malicious code. That allowed the hackers to crawl across a bank’s network until they found employees who administered the cash transfer systems or remotely connected A.T.M.s." So, to get infected all they had to do was just click "on the email"? Not even click on an attachment! That must be some strange, dangerous e-mail software!