SoylentNews is people
SoylentNews
from the check-that-you-don't-need-them dept.
In total, Microsoft has now blocked 142 file extensions that it deems as at risk or that are typically sent as malicious attachments in emails.
Microsoft is banning almost 40 new types of file extensions on its Outlook email platform. The aim is to protect email users from what it deems "at-risk" file attachments, which are typically sent with malicious scripts or executables.
The move will prevent users from downloading email attachments with various file extensions, including ones associated with Python, PowerShell, digital certificates, Java and more. Overall, Microsoft had blocked 104 file extensions from Outlook (a full list of which can be found here), including .exe, .url, .lnk, and more. With these newest extensions, that number will now rise to 142.
"We're always evaluating ways to improve security for our customers, and so we took the time to audit the existing blocked file list and update it to better reflect the file types we see as risks today," said Microsoft in a post this week.
Microsoft said that many of these newly-blocked file types are rarely used, so most organizations will not be affected by the change: "However, if your users are sending and receiving affected attachments, they will report that they are no longer able to download them," it said.
[...] Newly blocked file extensions include:
- Python scripting language: “.py”, “.pyc”, “.pyo”, “.pyw”, “.pyz”, “.pyzw”
- PowerShell scripting language:”.ps1″, “.ps1xml”, “.ps2”, “.ps2xml”, “.psc1”, “.psc2”, “.psd1”, “.psdm1”, “.psd1”, “.psdm1”, “.cdxml”, “.pssc”
- Java programming language: “.jar”, “.jnlp”
- digital certificates: “.cer”, “.crt”, “.der”
- Windows ClickOnce (“.appref-ms”)
- Microsoft Data Access Components (“.udl”)
- Windows Sandbox (“.wsb”)
Microsoft will also block various extensions being used by vulnerable applications, which could be used to exploit security vulnerabilities in third-party software, including: ".appcontent-ms", ".settingcontent-ms", ".cnt", ".hpj", ".website", ".webpnp", ".mcf", ".printerexport", ".pl", ".theme", ".vbp", ".xbap", ".xll", ".xnk", ".msu", ".diagcab", ".grp"
For these extensions, 38 in all, "while the associated vulnerabilities have been patched (for years, in most cases), they are being blocked for the benefit of organizations that might still have older versions of the application software in use," Microsoft said.
-- submitted from IRC
(Score: 2) by dry on Monday September 30 2019, @04:01AM (2 children)
Google at least seems to be using file or such to examine attachments and renaming no longer works, used to simply send zips as .ziq and executables with no extension.
(Score: 2) by Booga1 on Tuesday October 01 2019, @06:57PM (1 child)
Oh, I get that, but this is about Microsoft. They often just go by file extension since many of these formats are plain text on the inside. Unless it's a known virus, it gets through.
For what it's worth, the email system at one of my previous jobs did the same sort of scanning. It even allowed zips, but would scan up to 128 folders deep into a zip file. Though, it would reject anything with more folders than that.
In any case, this was in the official notification I got yesterday: Changes to File Types Blocked in Outlook on the web [microsoft.com]
It includes instructions on how to unblock file extensions your company needs(or block new ones). If your email admin knows what they're doing, they can exempt(or block) anything they want.
(Score: 2) by dry on Wednesday October 02 2019, @12:15AM
Well at lest they're allowing choice. Personally I just stay away form anything from MS.