&gt;&gt; <i>(The firewall would need to re-expand the rich text using this OLE, then scan the word doc, then repackage. Unsurprisingly nothing on market seems to. Jeez - stick to plain text) </i>
I&#x27;m really surprised that those dedicated anti-spam components like Barracuda, or those enterprise apps like ESET which hook into Exchange, don&#x27;t perform this sort of  analysis already. The volume of incoming mail even for a large organization would be pretty easy to analyze every single byte of every single message coming in and check it for certain things.<p>Barracuda rack-servers&#x27; sole purpose is to block spam and viruses, do they really not do deep-inspection? I mean every Win32 binary, even if packed, compressed, dynamically self-modifying, whatever, still needs an entry point. Those bytes still need to be embedded into your plain text somewhere, even if it isn&#x27;t via the SMTP attachment standard. The attack vector surely must have some commonality (haven&#x27;t read any post mortems but if it&#x27;s an OLE exploit, &quot;contentType=&quot;application&#x2F;vnd.ms-word&quot; is going to be there in straight up ASCII).<p>Either way, one might not know what&#x27;s in a binary, but you can definitively determine when something is a binary, at which point, anything which isn&#x27;t white-listed doesn&#x27;t get in. Is this just a matter of network admin&#x27;s not being able to be aggressive enough with their filtering policies and&#x2F;or GPO? The next line of defense would be to only let white-listed signed apps run which is fairly trivial with Win 10[1]. Disable the ability to install extensions in your white-listed browser (Firefox Youtube Downloader Plus!! Awesome!! is likely to have adware that&#x27;s bundled in), disable Flash, and one would have a pretty sanitary network right?<p>Edit: Yeah, I should have finished reading the article. He mentioned application whitelisting too as a defense. Critical environments with good security will not be effected by this. Also, the author mentioned &quot;most&quot; anti-viruses won&#x27;t detect this-- I don&#x27;t have a Barracuda box to test against, but I&#x27;ll bet $10 it catches this. So yeah, there are (quite a few) defenses within a properly locked down environment.<p>Clever find though.<p>[1] <a href="https:&#x2F;&#x2F;technet.microsoft.com&#x2F;en-us&#x2F;library&#x2F;dd723683(v=ws.10).aspx" rel="nofollow">https:&#x2F;&#x2F;technet.microsoft.com&#x2F;en-us&#x2F;library&#x2F;dd723683(v=ws.10...</a>