3 ms·

As you correctly state, the attachment is just a bunch of base64 encoded text with a file type specifier in MIME. "Opening" an attachment involves bundling it o

As you correctly state, the attachment is just a bunch of base64 encoded text with a file type specifier in MIME. "Opening" an attachment involves bundling it off to the shell for the shell to handle that file type. So, JPEGs get handled by the JPEG shell handler. DOCs get handled by the DOC shell handler. And unfortunately EXEs get handled by the EXE shell handler. This breaks the rule that you stated, that you should never ever permit data from an untrusted source to execute. This is where the problem lies! As far as "open" means, it is a piece of terminology to explain the concept of saving data to a temporary store and then passing that file reference to the shell, which typically for most programs gets passed as a parameter to that file-type-handling program. Explorer > Tools > Folder Options will list file types in there and you can see how different types are handled, and the parameters passed to programs. Of course, the base64 encoding, temporary file saving, shell passing is a bit more complex to explain to someone than using the expression "open", hence why people just say "open the attachment". It's a terminology thing.

graycat 12y ago
Yes, at least in the media, there is a lot of confusion about how e-mail and 'open' work. E.g., for https://news.ycombinator.com/item?id=9050436 https://news.ycombinator.com/item?id=9050436 about http://www.nytimes.com/2015/02/15/world/bank-hackers-steal-millions-via-malware.html http://www.nytimes.com/2015/02/15/world/bank-hackers-steal-m... in that NYT piece on hacking banks in Russia there is: "In many ways, this hack began like any other. The cybercriminals sent their victims infected emails — a news clip or message that appeared to come from a colleague — as bait. When the bank employees clicked on the email, they inadvertently downloaded malicious code. That allowed the hackers to crawl across a bank’s network until they found employees who administered the cash transfer systems or remotely connected A.T.M.s." So, to get infected all they had to do was just click "on the email"? Not even click on an attachment! That must be some strange, dangerous e-mail software!

graycat 12y ago

Yes, at least in the media, there is a lot of confusion about how e-mail and 'open' work. E.g., for https://news.ycombinator.com/item?id=9050436 https://news.ycombinator.com/item?id=9050436 about http://www.nytimes.com/2015/02/15/world/bank-hackers-steal-millions-via-malware.html http://www.nytimes.com/2015/02/15/world/bank-hackers-steal-m... in that NYT piece on hacking banks in Russia there is: "In many ways, this hack began like any other. The cybercriminals sent their victims infected emails — a news clip or message that appeared to come from a colleague — as bait. When the bank employees clicked on the email, they inadvertently downloaded malicious code. That allowed the hackers to crawl across a bank’s network until they found employees who administered the cash transfer systems or remotely connected A.T.M.s." So, to get infected all they had to do was just click "on the email"? Not even click on an attachment! That must be some strange, dangerous e-mail software!