Why is this a hidden filename extension?

[Robert Lopez]

On Fri, Sep 18, 2009 at 11:51 AM, Scott Silva <ssilva at sgvwater.com> wrote:
> on 9-18-2009 10:43 AM Robert Lopez spake the following:
>> Report: MailScanner: Attempt to hide real filename extension (Motion
>> %26 Order.doc)
>>
>> The above was a file name used by a college attorney and it the email
>> was blocked.
>> So it is a hot issue at the moment.
>>
>> The file command returns
>>
>> Microsoft Office Document Microsoft Word Document
>>
>> for the magic type so the content appears to match the extension.
>>
>>
>> I only see two deny rules in filename.rules.conf that seem to be
>> focused on filetype v extension:
>>
>> # Deny filenames containing CLSID's
>> deny    \{[a-hA-H0-9-]{25,}\}   Filename trying to hide its real type
>>                          Files containing  CLSID's are trying to hide
>> their real type
>>
>> # Deny all other double file extensions. This catches any hidden filenames.
>> deny    \.[a-z][a-z0-9]{2,3}\s*\.[a-z0-9]{3}$   Found possible
>> filename hiding                          Attempt to hide real filename
>> extension
>>
>> and there is also the white space rule
>>
>> # Deny filenames with lots of contiguous white space in them.
>> deny    \s{10,}         Filename contains lots of white space
>>                                  A long gap in a name is often used to
>> hide part of it
>>
>> but this filename does not match any of them to my understanding.
>>
>> What rule might have been matched?
>>
> The report has sanitized filenames. That might not be the full filename. You
> need to look at the original message.
>
>
> --
> MailScanner mailing list
> mailscanner at lists.mailscanner.info
> http://lists.mailscanner.info/mailman/listinfo/mailscanner
>
> Before posting, read http://wiki.mailscanner.info/posting
>
> Support MailScanner development - buy the book off the website!
>
>

In this case the report and the quarantine file use exactly the same filename.

-- 
Robert Lopez
Unix Systems Administrator
Central New Mexico Community College (CNM)
525 Buena Vista SE
Albuquerque, New Mexico 87106