Preventing Sophos potential false positive

Hello and welcome,

chossing this thread (instead of starting a new one) is IMO a godd decision as your post highlights a different aspect of false positives. While being flagged as "malicious" is more than unpleasant it not only happens with AV products but other services (especially email) as well.

Good to hear that it has been resolved.

I don't know what details Sophos told you. Anyway I'll put in my two cents. There are basically two ways to create blacklists. One is active scanning, the other collecting data during normal operation. An example of the former was probing for  "open mail relays" which then found themselves on blacklists (the use of these lists was optional and subject of fierce debate). "Decent" blacklisters informed (or tried to inform) the site's administrator in case of a detection. Nowadays active unsolicited scanning is practically unfeasible (even the big search engines no longer use it as their primary tool) and data is collected during normal operation. All major vendors' gateway products (email and web and network components) optionally collect data to identify "problem sites" which can help to improve performance but also protect against unknown threats. This information might also be used in client products. That's the rationale.

Now I imagine that there's quite some amount of (new) data every day. As there is no "standard contact" for a website it is not possible to send a notification automatically. I don't know if (and how) and under which circumstances Sophos (and other vendors) attempts to find a contact to send the notification to (I know they do). If you are wrongly blocked and haven't been informed (and are rather small) your best chance are your clients (and I might add this is also true if your site has indeed been compromised).

I wonder why companies such as Sophos feel that it is ok to damage the reputation of another company while not even having the regard to notify them of their actions.

I don't think that these companies are taking this lightly. The risk of false positives is always here and even bigger is the risk that the information is misinterpreted. But without protection it would be even worse. So it's always a trade off - sad as it is.

Christian

Hello and welcome,

chossing this thread (instead of starting a new one) is IMO a godd decision as your post highlights a different aspect of false positives. While being flagged as "malicious" is more than unpleasant it not only happens with AV products but other services (especially email) as well.

Good to hear that it has been resolved.

I don't know what details Sophos told you. Anyway I'll put in my two cents. There are basically two ways to create blacklists. One is active scanning, the other collecting data during normal operation. An example of the former was probing for  "open mail relays" which then found themselves on blacklists (the use of these lists was optional and subject of fierce debate). "Decent" blacklisters informed (or tried to inform) the site's administrator in case of a detection. Nowadays active unsolicited scanning is practically unfeasible (even the big search engines no longer use it as their primary tool) and data is collected during normal operation. All major vendors' gateway products (email and web and network components) optionally collect data to identify "problem sites" which can help to improve performance but also protect against unknown threats. This information might also be used in client products. That's the rationale.

Now I imagine that there's quite some amount of (new) data every day. As there is no "standard contact" for a website it is not possible to send a notification automatically. I don't know if (and how) and under which circumstances Sophos (and other vendors) attempts to find a contact to send the notification to (I know they do). If you are wrongly blocked and haven't been informed (and are rather small) your best chance are your clients (and I might add this is also true if your site has indeed been compromised).

I wonder why companies such as Sophos feel that it is ok to damage the reputation of another company while not even having the regard to notify them of their actions.

I don't think that these companies are taking this lightly. The risk of false positives is always here and even bigger is the risk that the information is misinterpreted. But without protection it would be even worse. So it's always a trade off - sad as it is.

Christian