2

I received a really classic spam mail stating that I have to pay a bill. The mail included an attachment (.exe). Just for curiosity reasons: What would happen if I click on the attachment? (I am running Crunchbang, no Wine installed)? Is there a way to securely inspect the attachment?

2

Nothing would happen since a .exe file is meant for Windows, not Linux, so without Wine installed, and without a association to run .exe files from your mail client these files are essentially of no consequence to you.

Still as a best practice you should typically never run things directly from email. You should instead get in the habit of doing a "Save As..." and then inspecting the file using tools such as file to confirm the file is as it's labeled.

Example

$ file <name of file>

If it looks clean then go ahead and open it.

Scanning for malware

If you're genuinely serious about scanning email for viruses/malware then there are a few tools and techniques I've used over there years. Before I get into it I'll suggest just punting and using GMail instead. They do a fantastic job and you can use fetchmail to download all the mail from GMail and still use mutt to read and send emails.

If on the other hand you're "into" doing everything yourself you can use these tools from mutt. For starters you can use spamassassin to scan incoming email.

Recipes in mutt such as this will run all messages through spamassassin:

:0fw
| spamassassin -P

:0e
EXITCODE==$?

You can also use a spam detection network to scan and flag emails from mutt using Vipul's Razor.

Vipul's Razor is a distributed, collaborative, spam detection and filtering network. Through user contribution, Razor establishes a distributed and constantly updating catalogue of spam in propagation that is consulted by email clients to filter out known spam. Detection is done with statistical and randomized signatures that efficiently spot mutating spam content. User input is validated through reputation assignments based on consensus on report and revoke assertions which in turn is used for computing confidence values associated with individual signatures.

NOTE: Setting both of these up is covered in this tutorial, titled: Spam-Fighting Tricks.

Mail servers

If you're really a masochist you can run your own mail server (I do this, using sendmail). With your own mail server you have a even larger arsenal of tools available such as:

  • spamassassin
  • milter-greylist
  • GeoIP
  • clamav
  • spamassassin-milter
  • clamav-milter
  • SPF

The above tools range from using a mix of online databases of emails that are known to be malware related, to blocking emails based on the geographic IP address that sent them to using DNS rules via SPF (Sender Policy Framework).

These solutions are what I would consider more enterprise grade but work very well, but require a fair amount of time and knowledge in setting them up and tending to them afterwards.

References

0

You might like running strings on the file.

This will show anything that looks like text that was compiled into the executable.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.