12

I was trying to send the eicar.com virus to someone to test an antivirus. When I've tried to send it as is, Google SMTP blocked it, saying that the software was malicious.

So I've zipped it with a simple password (1234) and it blocked it again. I assumed that the server somehow brute forced it because the password was too simple. So I've then tried to use a stronger password (jfdsg4453dsfsf), and it blocked it again.

For testing, I've also tried to send a similar non-virus file in a zipped, password-protected, archive, and it works.

So I'm wondering, how does Google know what contains a virus and what doesn't? Since I've used different passwords, it cannot check the hash or anything. Or is it that zipped archives can be easily brute forced?

Improve this question
  • 1
    @pnuts, the conditions when it didn't work (with the encrypted virus) and did work (with the encrypted non-virus) were the same. Same subject, same body and recipient. At first, I indeed thought it was recognizing the same email so was blocking it, but since it worked with the encrypted non-virus attachment, it must be something else. – laurent Sep 25 '14 at 8:19
6

Most likely, your archiver only encrypts file contents by default, and leaves filenames in clear text. This allows a user to browse the archive and selectively extract individual files by name. WinRAR is one such archiver.

Try renaming your file before archiving it, or enable filename encryption before sending.

Improve this answer
  • Are you saying Google only noticed the filename "eicar.com" in the archive and said it was a virus just based on that name? – pacoverflow Sep 26 '14 at 19:22
  • 3
    If the contents of the file are encrypted with a password, I’d say that’s likely. – user13779 Sep 26 '14 at 22:34
  • @Phong Winrar encrypts file names as well as contents and I'd sent password encrypted .rar files with non-malicious Javascript files before, they still got blocked. How far-fetched is it that Google owns enough computing power that it can brute-force and unlock encrypted .rar files? – pilau May 25 '16 at 22:15
  • @pacoverflow Probably just the ".com" extension was enough. A file with a ".com" extension is treated as an executable on Windows, though 64-bit versions won't be able to run it. This goes back to MS-DOS, where .COM was one of two supported executable formats, along with the more familiar .EXE. It's pretty obscure now, as not only is it obsolete, but ".com" has had an entirely different meaning on computers for quite a while. – flarn2006 Dec 10 '20 at 20:16
  • @pilau security.stackexchange.com/questions/35011/… Probably not, at least not enough computing power to do it every single time someone tries to email an encrypted .RAR archive. – flarn2006 Dec 10 '20 at 20:18
3

I think @Phong's answer is probably correct, but Gmail also blocks certain encrypted attachments no matter what.

Note, zip and tar.gz archives don't support an encrypted filelist but rar and 7z do.

From Gmail's help-page:

It isn't possible to send a password-protected zip file containing a zip file. Please de-compress all files or remove the password protection if possible.

I tried testing this, and I didn't see this very uniformly enforced.

To test, I tried to email myself 8 different compressed archives containing a non-virus binary, with and without encryption, and with and without an encrypted filelist. Oddly enough, the only file Google blocked was the content and filelist encrypted rar archive, which it reported as a "Blocked for security reasons!".

It allowed everything else, including the plain password protected zip file their help page claimed would be blocked, which is strange. You'd think if Gmail would block a filelist encrypted rar, they'd also block the open filelist rar? Maybe they saw the filename "definitely_not_a_virus.exe" and took my word for it?

The best part is this "protection" is easily foiled because it's entirely based on the file extension. If I give my filelist encrypted rar a txt extension, Gmail allows it.

Improve this answer
  • the only thing that worked for me was a 7z filename encoded and renamed to .txt – Scott Driscoll Nov 3 '17 at 12:23
  • It's a good thing that it's easily foiled, really. It shouldn't be there in the first place, unless you can turn it off. – flarn2006 Dec 10 '20 at 20:10
2

https://productforums.google.com/forum/#!topic/gmail/tV6fsa5Sckc

Currently Gmail blocks any of

  • Archives whose listed file content is password protected
  • Archives whose content includes a password protected archive

regardless of the contents.

The only solution is to rename the file or use Google Drive attachment as forums link above suggests.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.