Menu
Gmail will block JavaScript attachments, a common source of malware

Gmail will block JavaScript attachments, a common source of malware

In February, the .JS file extension will be added to a list of 31 file types that Gmail already blocks

Starting Feb. 13, Google will no longer allow JavaScript attachments on its Gmail service, killing one of the main methods of malware distribution over the past two years.

Users will no longer be able to attach .JS files to emails in Gmail, regardless of whether they attach them directly or they include them in archives like .gz, .bz2, .zip or .tgz. For those rare cases when such files need to be shared via email, users can upload them to a storage service like Google Drive and then share the link.

The .JS file extension will be added an existing list of other banned file attachments that includes: .ADE, .ADP, .BAT, .CHM, .CMD, .COM, .CPL, .EXE, .HTA, .INS, .ISP, .JAR, .JSE, .LIB, .LNK, .MDE, .MSC, .MSP, .MST, .PIF, .SCR, .SCT, .SHB, .SYS, .VB, .VBE, .VBS, .VXD, .WSC, .WSF and .WSH. Most of these file types have long been abused by cybercriminals to send malware via email.

The same thing has happened with .JS over the past two years, especially since JavaScript files can be executed directly on Windows thanks to a system component called the Windows Script Host (WSH).

The JavaScript files, which are typically obfuscated, can serve as downloaders for other malware and have been especially preferred by ransomware pushers. Widespread threats like TeslaCrypt and Locky have used this method of distribution and one particular ransomware program dubbed RAA was written completely in JavaScript.

"Be wary of emails with JavaScript attachments," researchers with Microsoft's Malware Protection Center warned in a blog post in April. "It is uncommon and quite suspicious for people to send legitimate applications in pure JavaScript file format (files with .js or .jse extension) via email. Do not click or open it."

Other scripting files like .VBS (VBScript), .VBE (VBScript Encoded), .WSH (Windows Script Host Settings File) and .WSF (Windows Script File) -- all of which Gmail already blocks -- can be used in a similar way.

The general rule is that if you don't recognize a file type and don't know what it does, you should never open it. If you are expecting files in unusual formats, you should always double check the source before opening them and it would be best not to share them via email.


Follow Us

Join the newsletter!

Or

Sign up to gain exclusive access to email subscriptions, event invitations, competitions, giveaways, and much more.

Membership is free, and your security and privacy remain protected. View our privacy policy before signing up.

Error: Please check your email address.

Featured

Slideshows

Meet the leading customer-centric Microsoft channel partners

Meet the leading customer-centric Microsoft channel partners

Microsoft honoured leading partners across the channel following a year of customer innovation and market growth in New Zealand. The 2018 Microsoft Partner Awards recognised excellence within the context of the end-user, spanning a host of emerging and established providers.

Meet the leading customer-centric Microsoft channel partners
Reseller News launches new-look Awards at 2018 Judges’ Lunch

Reseller News launches new-look Awards at 2018 Judges’ Lunch

Introducing the Reseller News Innovation Awards, launched to the channel at the 2018 Judges’ Lunch in Auckland. With more than 70 judges now part of the voting panel, the new-look awards will reflect the changing dynamics of the channel, recognising excellence across customer value and innovation - spanning start-ups, partners, distributors and vendors.

Reseller News launches new-look Awards at 2018 Judges’ Lunch
Show Comments