What is Benign?
Benign is a system for processing and filtering email as it is downloaded. The aim of the processing and filtering operations is to remove a number of potential risks to your privacy and security, including (but not limited to) web bugs, scripting viruses, worms, trojans and other potentially malicious content.
How does Benign work?
In the absence of a system such as Benign, email programs download new messages by contacting the remote server on which their email is currently stored and using a standard Internet protocol, POP3, to perform the download.
Benign is a program that is run on your own computer and works by reconfiguring the email program to contact Benign, instead of the remote server, when downloading messages. Benign can intercept and monitor the POP3 session while it is in progress.
When the email program attempts to download a message, Benign sends the download command on to the remote server, but intercepts the mail as it is sent back from the remote server. Benign then processes and filters the message before passing the message on to the email program.
In this way Benign is able to perform the desired processing and filtering operations on incoming email regardless of the email program software or POP3 server software.
Why should I use Benign and how does it compare to conventional anti-virus products?
Benign interprets and rewrites every aspect of emails. It protects not only against known security problems but also against a large number of attacks yet to be discovered. Whereas most conventional anti-virus products can only deal with the selection of problems they know about. Benign frees you from the continual "arms race" scramble to protect yourself as new attack vectors are found.
Benign rewrites the email to guarantee that the end-user mail software will interpret it as it should - unlike conventional anti-virus products, which are easy to defeat by exploiting differences in the filtering software and the end-user mail software.
The key thing that makes Benign different is the approach that Benign takes to ensure the security of its users. The majority of conventional anti-virus products have attempted to solve the problem by trying to scan for the specific problems they are aware of. Benign does it "the proper way" - it fully decodes the email, removes anything dangerous or malicious and then rewrites the email in such a way as to guarantee that it will be interpreted by the mail software as it should be.
This last point is critical. A number of commercial mail-filtering alternatives to Benign examine the email and determine whether it seems to be safe. However, their failing is that they assume that the mail software itself interprets the email in the same way that they do, but since they do not rewrite the email as they understand it, there is no such guarantee. Therefore, there are many ways to construct emails such that the mail gateway will allow it through, having interpreted it one way, but the mail software sees something quite different. The problem is especially bad due to the sheer number of alternative ways of encoding a given email, using (for example) Unicode, which, unlike Benign, most content-filtering software cannot interpret.
Benign's protection functionality includes:
- Removing known dangerous attachments.
- Removing possibly dangerous attachments.
- Filtering maliciously constructed attachment filenames that can exploit buffer overflows, or confuse the user into believing the file is of another type.
- Removing scripting and embedded tags and attributes from HTML emails.
- Removing other non-standard tags that can be used to sneak scripting and other attacks into emails.
- Removing layers, frames and other tags that can be used to load web pages in the email, bypassing mail gateway content and spam filtering and opening additional avenues of attack.
Further functionality Benign provides is privacy protection, primarily by filtering web bugs. (What is a web bug?) Web bugs have risen to prominence in the last year, primarily due to their role in confirming that a recipient's address is working, and have become one of the most valued items in the toolboxes of spammers and direct marketers. Web bugs provide a nearly guaranteed way to determine what addresses are still working, which of those recipients are viewing the emails and even information such as how long the email was viewed for and from what country.
Benign examines every image in the email (and other such remote content) and checks to see if it is a web bug; if so, it filters it. Benign can filter not only web bugs from known web bug providers, but can also detect images that are most probably web bugs, based on the URL and other attributes and filter them also. Combined with the protection provided by Benign's security filtering (to ensure, for example, that scripting cannot be used to inject web bugs), this provides Benign with "best of breed" privacy protection for email.
How do I start using Benign?
Download and install the software. During installation of Benign you will be asked what level of security is required - Low, Medium or High. We recommend Low for the first time users. That is all you have to do. Benign runs in the background and does all the work for you. No intervention from you is required.