Arch Linux

heleos

Member

From: Maine, USA

Registered: 2007-04-24

Posts: 678

tar vs zip (security)

Today I got an e-mail from IT at work, stating that they are going to begin blocking .tar attachments, and allow .zip attachments. This made me wonder if there is a security problem with tar, or if the company is just afraid of anything linux

SiC

Member

From: Liverpool, England

Registered: 2008-01-10

Posts: 430

Re: tar vs zip (security)

Hmmm... Did they give you reasons as to why they were going to block tar files?? The only fundamental difference between tar and zip is that zip is a natively compressed format, whereas tar is just a filesystem archive, much the same as .iso which is why they are usually compressed (.tar.gz or .tgz). They might as well start blocking .ace or .rar files.

arch0r

Member

From: From the Chron-o-John

Registered: 2008-05-13

Posts: 597

Re: tar vs zip (security)

tar: used by bad *nix hax0rs aiming to damage windoze users

actually it makes no sense to me blocking tar files. they're whether encrypted nor cmpressed

SiC

Member

From: Liverpool, England

Registered: 2008-01-10

Posts: 430

Re: tar vs zip (security)

tar: used by bad *nix hax0rs aiming to damage windoze users

actually it makes no sense to me blocking tar files. they're whether encrypted nor cmpressed

Me either, unless they are operating a blanket block on all files other than those they have decided upon. But even then if they allow .doc or .xls files, then they are MASSIVELY open to security problems, so they can't use that excuse.  It's probably typical BOFH behaviour where they are on a power trip.

heleos

Member

From: Maine, USA

Registered: 2007-04-24

Posts: 678

Re: tar vs zip (security)

There is a list of probably 40 blocked file extensions, but no problem with sending .doc and .xls files. Also, they encourage using VBA macros!

edit: the reason in the email was "blah blah blah, due to the number of new viruses, we're now blocking the following attachments: ..."

Last edited by heleos (2008-08-13 20:10:07)

SiC

Member

From: Liverpool, England

Registered: 2008-01-10

Posts: 430

Re: tar vs zip (security)

Email them back and tell them Bollocks.

cactus

Taco Eater

From: t͈̫̹ͨa͖͕͎̱͈ͨ͆ć̥̖̝o̫̫̼s͈̭̱̞͍̃!̰

Registered: 2004-05-25

Posts: 4,622

Website

Re: tar vs zip (security)

the *only* thing I could think of is maybe they have an inline AV scanner that doesn't support on the fly extraction/scanning of tar files, but does support it with zip files.
Other than that (slim chance), I would have no idea why they would block tar files.

---

"Be conservative in what you send; be liberal in what you accept." -- Postel's Law
"tacos" -- Cactus' Law
"t̥͍͎̪̪͗a̴̻̩͈͚ͨc̠o̩̙͈ͫͅs͙͎̙͊ ͔͇̫̜t͎̳̀a̜̞̗ͩc̗͍͚o̲̯̿s̖̣̤̙͌ ̖̜̈ț̰̫͓ạ̪͖̳c̲͎͕̰̯̃̈o͉ͅs̪ͪ ̜̻̖̜͕" -- -̖͚̫̙̓-̺̠͇ͤ̃ ̜̪̜ͯZ͔̗̭̞ͪA̝͈̙͖̩L͉̠̺͓G̙̞̦͖O̳̗͍

Garns

Member

Registered: 2008-05-28

Posts: 239

Re: tar vs zip (security)

the *only* thing I could think of is maybe they have an inline AV scanner that doesn't support on the fly extraction/scanning of tar files, but does support it with zip files.
Other than that (slim chance), I would have no idea why they would block tar files.

If that's the case, they should get a new scanner...

catwell

Member

From: Bretagne, France

Registered: 2008-02-20

Posts: 207

Website

Re: tar vs zip (security)

Maybe they mistook tar for rar? I think a lot of Windows viruses come in rar archives.

heleos

Member

From: Maine, USA

Registered: 2007-04-24

Posts: 678

Re: tar vs zip (security)

nope, .rar was also blocked

shining

Pacman Developer

Registered: 2006-05-10

Posts: 2,043

Re: tar vs zip (security)

What about tar.gz and tar.bz2 ?

---

pacman roulette : pacman -S $(pacman -Slq | LANG=C sort -R | head -n $((RANDOM % 10)))

Daenyth

Forum Fellow

From: Boston, MA

Registered: 2008-02-24

Posts: 1,244

Re: tar vs zip (security)

You should see if sending a file with no extension works. just mv foo.tar foo; then send it in a mail. Save as foo.tar when it gets to the other side. Of course there's no huge reason to.

Mostly it sounds like the admins there are completely incompetant.

---

[git] | [AURpkgs] | [arch-games]

sokuban

Member

Registered: 2006-11-11

Posts: 412

Re: tar vs zip (security)

the *only* thing I could think of is maybe they have an inline AV scanner that doesn't support on the fly extraction/scanning of tar files, but does support it with zip files.
Other than that (slim chance), I would have no idea why they would block tar files.

I sometimes use tar to send exe files to friends when either of our freemail services doesn't allow us to send exes. (Most freemail can scan zip files but not tar)

I don't think the chance is as slim as you believe.

heleos

Member

From: Maine, USA

Registered: 2007-04-24

Posts: 678

Re: tar vs zip (security)

well to get around the blocked zip files, we used to remove the zip extention and sent it.

Obi-Lan

Member

From: Finland

Registered: 2007-05-23

Posts: 179

Re: tar vs zip (security)

Personally I don't like to send files via email, there are better protocols for it.

sokuban

Member

Registered: 2006-11-11

Posts: 412

Re: tar vs zip (security)

What do you use then?

carlocci

Member

From: Padova - Italy

Registered: 2008-02-12

Posts: 368

Re: tar vs zip (security)

Today I got an e-mail from IT at work, stating that they are going to begin blocking .tar attachments, and allow .zip attachments. This made me wonder if there is a security problem with tar, or if the company is just afraid of anything linux

Maybe you can natively open zip files in Windows XP and not tgz or rar?

.:B:.

Forum Fellow

Registered: 2006-11-26

Posts: 5,819

Website

Re: tar vs zip (security)

Idiots at the IT department? Happens all the time I guess.

Of course as a 'workaround' you can rename your .tar{,.gz,.bz2} archives to .zip and get them through the firewall that way, it's not unprobable it only filters on extension, and does not check the header (like tar does when it tries to extract a tarball).

---

Got Leenucks? :: Arch: Power in simplicity :: Get Counted! Registered Linux User #392717 :: Blog thingy

Obi-Lan

Member

From: Finland

Registered: 2007-05-23

Posts: 179

Re: tar vs zip (security)

What do you use then?

If the file is <10mb and I know that receiver don't know what ftp or http is I send it trough email. For our company internal file exchange I just use windows file shares. If the file is big I just put it on our http server.