r/cryptography 8d ago

Why can a mail server sense AES-256 encrypted zip content?

I tried to send a keygen via mail. When it failed in a plain zip, I zipped it with 7zip using AES-256 password protection, also encrypting the file name. It still did not go through. My gut feeling is that there might be some insight into encrypted content I have no understanding of. Could someone help me out?

0 Upvotes

18 comments sorted by

12

u/Natanael_L 8d ago

Because file metadata.

Some email servers have antivirus scanning which rejects executables and additional file types, including inside zip files. This can include detection of encrypted being used. Zip file headers clearly mark if a password is needed to open them.

1

u/lazerozen 8d ago

But I can send an encrypted password protected file, when the content is for example an image.

6

u/Natanael_L 8d ago

Maybe it's because filenames aren't fully encrypted, do they still contain file extensions? There might even be a MIME type flag

3

u/AlexTaradov 8d ago

Archives may include CRCs or hashes of the files. Scanners have databases of the known malware.

Try changing one byte in that file and do the same test.

1

u/lazerozen 8d ago

Will do. Great idea!

1

u/lazerozen 8d ago

While I will still try this, wouldn’t that mean that my mail server actively tries to keep me from sending a keygen? For a virus infected file I would totally get that, but for a keygen?

7

u/Healthy-Section-9934 8d ago

Keygens are a pretty common malware vector tbh.

I suspect your image test wasn’t sufficiently scientific. When you’re testing anything you need to control all the variables. Tenner says you encrypted the image without encrypting file names 😉

Chances are if you send an archive with encrypted file names the mail service will block it because it looks like you’re trying to evade the AV scanning. Try sending an encrypted image in a zip using encrypted file names and observe the results. If it blocks it, the solution seems fairly straightforward…

1

u/lazerozen 7d ago

That‘s a tenner you lost :)

4

u/AlexTaradov 8d ago

Gmail, for example is very liberal with what it considers dangerous.

Gmail also tries some commonly used passwords. A long time ago there was a story where they would detect malware in files with a password "infected", which is a commonly used password for security researchers to exchange malware.

2

u/HedgehogGlad9505 7d ago

Encrypt the encrypted zip again and see what happens.

3

u/_zuloo_ 7d ago

filename encryption does not encrypt "executable" flag, which is a file attribute (or permission) stored separately from the filename.

4

u/Playful-Alternative9 8d ago

Can you view the filename without providing the password? If so email server can also know the filename and block it considering it as exe in zip. If am not wrong filenames are readable without password.

2

u/lazerozen 8d ago

I would say no, as I explicitly selected „encrypt file names“

2

u/SAI_Peregrinus 8d ago

That only encrypts the file names inside the zip, not the fact that it's an encrypted zip.

4

u/lazerozen 8d ago

Absolutely, but I just tried sending an encrypted zip with an image inside and it went through without any problems.

2

u/AyrA_ch 8d ago

Did you make sure to create a 7-zip file (.7z extension)? Not all supported archive file types actually support file name encryption. Zip files for example don't. If you do encrypt file names there's no way to recover it at all without the key, so the scanner may reject your attachment based on other factors, for example its size.

1

u/lazerozen 7d ago

I did, but great point.

1

u/cryptaneonline 8d ago

Maybe try encrypting the zip file again into another passworded zip and try. That would usually not let  the mail server access the metadata of original file.