Ethical Hacking

Learn to find vulnerabilities before the bad guys do! Gain real world hands on hacking experience in our state of the art hacking lab. Course designed and taught by expert instructors with years of penetration testing experience. 12 student maximum in every class. Certification attempt included in every package.
Computer Forensics Training at InfoSec Institute

Gain the in-demand skills of a certified computer examiner, learn to recover trace data left behind by fraud, theft, and cybercrime perpetrators. Discover the source of computer crime and abuse at your organization so that it never happens again. All of our class sizes are guaranteed to be 12 students or less to facilitate one-on-one interaction with one of our expert instructors.




Network Security Pen-Test
[Top] [All Lists]

RE: Filtering email headers generated from internal network (Sensible?)

Subject: RE: Filtering email headers generated from internal network (Sensible?)
Date: Tue, 10 May 2005 01:27:03 +0200
Hello Bipin,

Since the cost of implementing a filter to remove the MIME fields you
mentioned is very low, I highly recommend it.
This is very similar to recommending to remove the server field of the HTTP
response in web servers.

From my point of view, you can only gain from filtering this data.

Best regards,
Eyal Udassin - Swift Coders
POB 1596 Ramat Hasharon, 47114
972+547-684989
eyal@swiftcoders.com
www.swiftcoders.com

-----Original Message-----
From: Bipin Gautam [mailto:visitbipin@hotmail.com] 
Sent: Monday, May 09, 2005 5:36 PM
To: pen-test@securityfocus.com
Subject: Filtering email headers generated from internal network (Sensible?)





Is it sensible to filter extra email headers in the gateway generated from
your internal network before it leaves your server, so that Information
like...   User-Agent:, X-Virus-Scanned:,  and those EXTRA hopps of  Received
from: (headers........)     won't leak out, which could be a valuable
information for a potential intruder. Moreover the trouble multiplies if a
software exploit is realesed before patch. It is kinda Security by
obscurity. But if it buys you some extra time to act isn't is sensible to
impliment or just too paranoid? 

drop your views,
Bipin Gautam
http://bipin.sosvulnerable.net/



<Prev in Thread] Current Thread [Next in Thread>