**Federal Agency Security Practices**

**TITLE: How to Protect Against Viruses Using Attachment Blocking**

Version 1.0, 2/5/02

Brett Bobley

Chief Information Officer

National Endowment for the Humanities

http://www.neh.gov/

bbobley@neh.gov

\(202\) 606-8401

Clay Vaughan

Security Officer

National Endowment for the Humanities

http://www.neh.gov/

cvaughan@neh.gov

\(202\) 606-8407

**[Introduction]{.underline}**

Stopping viruses has become one of the most time-consuming duties for
the IT security officer. It is, of course, critical that all federal
agencies install anti-virus software and keep it up-to-date. In addition
to the traditional anti-virus software approach, there is a second
technique you should consider that can greatly enhance your ability to
prevent virus infections. That technique is \"attachment blocking.\"

The vast majority of viruses propagate via a file that is attached to an
e-mail. After the unsuspecting user executes this attachment, the virus
attempts to infect the system. Hopefully, the system is running the most
up-to-date version of anti-virus software. If so, it will probably
prevent the machine from becoming infected. But what if this is a brand
new virus and your anti-virus software hasn\'t yet been updated to stop
it? In that case, the system will become infected.

Attachment blocking adds a first line of defense to prevent this from
happening. By blocking the attachment altogether before it reaches the
end user, the virus never even gets to the desktop. This FASP discusses
using attachment blocking as a supplement to your normal anti-virus
practices.

**[Viruses and E-Mail Attachments]{.underline}**

According to Computer Associates, a leading anti-virus software vendor,
these are the \"top-ten\" viruses for calendar year 2001:

1\. Win32.Badtrans.B

2\. Win32.Sircam.137216

3\. Win32.Magistr

4\. Win32.Badtrans.13312

5\. Win32.Magistr.B

6\. Win32.Hybris.B

7\. Win95.MTX

8\. Win32.Nimda.A

9\. VBS.VBSWG.Generic

10\. Win32.Goner.A

Of the top ten viruses, *nine* of them use e-mail attachments to
propagate. Only Nimba, which infects web servers only, does not. For
example, Badtrans uses attachments that end in .PIF and .SCR to infect
the end-user\'s system. Magistr uses .EXE. VBSWG (like the Lovebug virus
from a few years ago) uses .VBS.

At my agency, the National Endowment for the Humanities, my anti-virus
program never had to battle a single instance of any of these viruses.
Why? Because we were blocking these attachment types at the mail server.
Hence, the viruses never even reached the desktop. So even though we
diligently kept our anti-virus software up to date, we never had to
worry about being infected by new viruses, as we were already protected.
This additional line of defense made a huge difference in keeping our
systems safe.

**[Blocking Attachments by File Extension]{.underline}**

The key to attachment blocking is to block any and all attachments that
might really be a virus. This can be done by blocking attachments by
file extension. For example, by blocking all attachments that end in
.PIF and .SCR, you can completely eliminate the BadTrans virus, which
was the number one virus for 2001. Here at the NEH, we recommend
blocking, at minimum, the following attachment types: .BAT, .CMD, .COM,
.DAT, .EML, .EXE, .LNK, .PIF, .SCR, .VBS.

**[Pros and Cons of Attachment Blocking]{.underline}**

There is one obvious \"con\" of attachment blocking. What if a
legitimate user sends me an e-mail with, say, a \".EXE\" attachment?
Since my system is blocking such attachments, I\'ll never get it. This
is an issue that you\'ll need to address. Here at the NEH, we were
concerned about this as well. But what we have discovered after doing
attachment blocking for a few years is that this is really a non-issue.
The vast majority of your users will be receiving e-mails with word
processing and spreadsheet attachments. There are very few users who
have a legitimate business need to receive files with .EXE, .VBS, .SCR,
etc. In fact, practically every .EXE that comes into our mail server is
either a virus or is an unwanted or illegal piece of junk software like
a game or screensaver or some such thing.

What about the members of your IT staff, you ask? It is true that the
programmers and other IT people on your staff may need to send .EXE and
.VBS files to each other. But they can simply compress the files into
.ZIP files or into some other kind of archive first. Then the files can
go right though. For the vast majority of government users, blocking
these file types will not cause undue inconvenience.

The \"pros\" of attachment blocking are overwhelming: without
exaggeration, my agency has not had a single infection since installing
attachment blocking. When new viruses come out, we rarely even notice
them, as we don\'t receive any at all. Since we are blocking the
attachments at the mail server, they never reach our system and our
anti-virus program doesn\'t even need to do anything. The anti-virus
software is still important, of course, as our second line of defense.
It is also important for scanning files that may come via floppy disk or
CD-ROM. But almost all our viruses are stopped cold by attachment
blocking.

**[How to Configure Attachment Blocking]{.underline}**

There are numerous ways to block attachments. Typically, you block them
on your mail server or on your firewall as they first enter your agency.
There are many mail servers that allow you to easily block attachments,
including most Unix-based mailers like sendmail and procmail. In
addition, numerous firewall systems allow you to examine incoming mail
traffic and perform blocking. Of course, check your documentation for
details. Here at the NEH we use Gordano\'s NTMail (www.gordano.com) on
our firewall as our front-end SMTP server. All incoming/outgoing mail
passes through this server before getting on our LAN. (Inside the LAN,
we use Microsoft Exchange. However, the blocking is done before Exchange
ever sees the mail). By going into the NTMail JUCE option, you can
simply specify which attachments to block by file extension (e.g. .PIF,
.EXE). Any mail with such an attachment is rejected by the mail server
and a message is sent back to the sender which says: \"550 Unacceptable
attachment (170).\" Hence, the recipient never gets the e-mail with the
bad attachment.

Another related feature that many mail servers support is the idea of
blocking a message based on text found in the subject or in the body.
This can be handy if a particular virus always has the same phrase in
the subject. That way, you can block it based on that phrase even if the
attachment is a type you don\'t block. Again, consult your own
documentation to see how to block attachments on your system.