This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Mail scanner does not detect incoming Malware.

I recieved a phishing email with an attachment, the mail was classed as spam and quarantined.

I released the mail from quarantine and once I was sure it was a phising email I forwarded it to the security department at the organisation it perported to come from.

I immeadiately got a bounce from my UTM that the mail had a malware attachment !!

"Your message to the following recipients was quarantined:

<phishing@hmrc.gsi.gov.uk>, quarantine reason: Malware (Troj/DocDl-HKN)

Please contact your IT administrator for further assistance."


This means that the scanner missed it on the way in !
I have no whitelisting to prevent any antivirus scanning and use dual scan.

UTM v9.411-3

This would appear as a rather severe bug

Jeff

This thread was automatically locked due to age.

Parents

rfcat_vk over 7 years ago

Hi,

what you haven't told us is your incoming mail setup.

Do you use imap because the UTM doesn't scan imap currently only smtp and pop3.

The malware would have been caught on the wayout by the smtp scanning.

Please put ina feature request for imap scanning.

XG115W - v20 GA - Home

XG on VM 8 - v20 GA

If a post solves your question please use the 'Verify Answer' button.
Cancel
Vote Up 0 Vote Down

Cancel
JeffreyLewcock over 7 years ago in reply to rfcat_vk

Sorry,

Came in via SMTP Proxy

Was marked as spam, when I released it and forwarded I got the message.

Log:

/var/log/smtp/2017/02/smtp-2017-02-15.log.gz:2017:02:15-13:50:51 firewall exim-in[7784]: 2017-02-15 13:50:51 H=(hmrcg0v.co.uk) [146.20.65.136]:54525 Warning: jimbojones.com profile excludes greylisting: Skipping greylisting for this message
/var/log/smtp/2017/02/smtp-2017-02-15.log.gz:2017:02:15-13:50:51 firewall exim-in[7784]: 2017-02-15 13:50:51 H=(hmrcg0v.co.uk) [146.20.65.136]:54525 Warning: jimbojones.com profile excludes SANDBOX scan
/var/log/smtp/2017/02/smtp-2017-02-15.log.gz:2017:02:15-13:50:52 firewall exim-in[7784]: 2017-02-15 13:50:52 [146.20.65.136] F=<service-jimbo=jimbojones.com@hmrcg0v.co.uk> R=<jimbo@jimbojones.com> Verifying recipient address with callout
/var/log/smtp/2017/02/smtp-2017-02-15.log.gz:2017:02:15-13:51:13 firewall exim-in[7784]: 2017-02-15 13:51:13 1cdzyu-00021Y-1J DKIM: d=hmrcg0v.co.uk s=key c=relaxed/relaxed a=rsa-sha1 [invalid - public key record (currently?) unavailable]
/var/log/smtp/2017/02/smtp-2017-02-15.log.gz:2017:02:15-13:51:14 firewall exim-in[7784]: 2017-02-15 13:51:14 1cdzyu-00021Y-1J <= service-jimbo=jimbojones.com@hmrcg0v.co.uk H=(hmrcg0v.co.uk) [146.20.65.136]:54525 P=esmtp S=146907 id=0.0.0.0.1D287917DA14CAC.1AC5FEA0@hmrcg0v.co.uk
/var/log/smtp/2017/02/smtp-2017-02-15.log.gz:2017:02:15-13:51:14 firewall exim-in[7784]: 2017-02-15 13:51:14 SMTP connection from (hmrcg0v.co.uk) [146.20.65.136]:54525 closed by QUIT
/var/log/smtp/2017/02/smtp-2017-02-15.log.gz:2017:02:15-13:51:20 firewall smtpd[7932]: SCANNER[7932]: 1cdzzM-00023w-Dv <= service-jimbo=jimbojones.com@hmrcg0v.co.uk R=1cdzyu-00021Y-1J P=INPUT S=145531
/var/log/smtp/2017/02/smtp-2017-02-15.log.gz:2017:02:15-13:51:20 firewall smtpd[7932]: SCANNER[7932]: id="1001" severity="info" sys="SecureMail" sub="smtp" name="email quarantined" srcip="146.20.65.136" from="service-jimbo=jimbojones.com@hmrcg0v.co.uk" to="jimbo@jimbojones.com" subject="HMRC Secure Communication" queueid="1cdzzM-00023w-Dv" size="145531" reason="as" extra=""
/var/log/smtp/2017/02/smtp-2017-02-15.log.gz:2017:02:15-23:03:00 firewall exim-out[8786]: 2017-02-15 23:03:00 1cdzzM-00023w-Dv => jimbo@jimbojones.com P=<service-jimbo=jimbojones.com@hmrcg0v.co.uk> R=static_route_hostlist T=static_smtp H=My.LAN.IP.2 [My.LAN.IP.2]:25 C="250 2.0.0 Ok: queued as 929496086CE0"
Cancel
Vote Up 0 Vote Down

Cancel

Reply

JeffreyLewcock over 7 years ago in reply to rfcat_vk

Sorry,

Came in via SMTP Proxy

Was marked as spam, when I released it and forwarded I got the message.

Log:

/var/log/smtp/2017/02/smtp-2017-02-15.log.gz:2017:02:15-13:50:51 firewall exim-in[7784]: 2017-02-15 13:50:51 H=(hmrcg0v.co.uk) [146.20.65.136]:54525 Warning: jimbojones.com profile excludes greylisting: Skipping greylisting for this message
/var/log/smtp/2017/02/smtp-2017-02-15.log.gz:2017:02:15-13:50:51 firewall exim-in[7784]: 2017-02-15 13:50:51 H=(hmrcg0v.co.uk) [146.20.65.136]:54525 Warning: jimbojones.com profile excludes SANDBOX scan
/var/log/smtp/2017/02/smtp-2017-02-15.log.gz:2017:02:15-13:50:52 firewall exim-in[7784]: 2017-02-15 13:50:52 [146.20.65.136] F=<service-jimbo=jimbojones.com@hmrcg0v.co.uk> R=<jimbo@jimbojones.com> Verifying recipient address with callout
/var/log/smtp/2017/02/smtp-2017-02-15.log.gz:2017:02:15-13:51:13 firewall exim-in[7784]: 2017-02-15 13:51:13 1cdzyu-00021Y-1J DKIM: d=hmrcg0v.co.uk s=key c=relaxed/relaxed a=rsa-sha1 [invalid - public key record (currently?) unavailable]
/var/log/smtp/2017/02/smtp-2017-02-15.log.gz:2017:02:15-13:51:14 firewall exim-in[7784]: 2017-02-15 13:51:14 1cdzyu-00021Y-1J <= service-jimbo=jimbojones.com@hmrcg0v.co.uk H=(hmrcg0v.co.uk) [146.20.65.136]:54525 P=esmtp S=146907 id=0.0.0.0.1D287917DA14CAC.1AC5FEA0@hmrcg0v.co.uk
/var/log/smtp/2017/02/smtp-2017-02-15.log.gz:2017:02:15-13:51:14 firewall exim-in[7784]: 2017-02-15 13:51:14 SMTP connection from (hmrcg0v.co.uk) [146.20.65.136]:54525 closed by QUIT
/var/log/smtp/2017/02/smtp-2017-02-15.log.gz:2017:02:15-13:51:20 firewall smtpd[7932]: SCANNER[7932]: 1cdzzM-00023w-Dv <= service-jimbo=jimbojones.com@hmrcg0v.co.uk R=1cdzyu-00021Y-1J P=INPUT S=145531
/var/log/smtp/2017/02/smtp-2017-02-15.log.gz:2017:02:15-13:51:20 firewall smtpd[7932]: SCANNER[7932]: id="1001" severity="info" sys="SecureMail" sub="smtp" name="email quarantined" srcip="146.20.65.136" from="service-jimbo=jimbojones.com@hmrcg0v.co.uk" to="jimbo@jimbojones.com" subject="HMRC Secure Communication" queueid="1cdzzM-00023w-Dv" size="145531" reason="as" extra=""
/var/log/smtp/2017/02/smtp-2017-02-15.log.gz:2017:02:15-23:03:00 firewall exim-out[8786]: 2017-02-15 23:03:00 1cdzzM-00023w-Dv => jimbo@jimbojones.com P=<service-jimbo=jimbojones.com@hmrcg0v.co.uk> R=static_route_hostlist T=static_smtp H=My.LAN.IP.2 [My.LAN.IP.2]:25 C="250 2.0.0 Ok: queued as 929496086CE0"
Cancel
Vote Up 0 Vote Down

Cancel

Children

rfcat_vk over 7 years ago in reply to JeffreyLewcock

While I was wrong about the scanning process, you appear to have some exclusions setup in the UTM which you need to address.

XG115W - v20 GA - Home

XG on VM 8 - v20 GA

If a post solves your question please use the 'Verify Answer' button.
Cancel
Vote Up 0 Vote Down

Cancel
JeffreyLewcock over 7 years ago in reply to rfcat_vk

Hi,

What exclusions are you talking about, I have no exclusions that would preclude virus scanning that I know of. I have checked my setup.

But will check again though there is no way I would knowingly exclude virus scanning.

Jeff
Cancel
Vote Up 0 Vote Down

Cancel
rfcat_vk over 7 years ago in reply to JeffreyLewcock

Hi Jeff,

please read the log extracts you pasted, there are exceptions reported all through them.

If you can track down who created the exceptions in the source yuo use as a reference you will more than likely find who is trying to access your network.

XG115W - v20 GA - Home

XG on VM 8 - v20 GA

If a post solves your question please use the 'Verify Answer' button.
Cancel
Vote Up 0 Vote Down

Cancel
JeffreyLewcock over 7 years ago in reply to rfcat_vk

Hi Rfcat

I have checked my seting again and found nothing that excludes virus (Malware) scanning.

I can only see two exclusions in the log I posted

1) Greylisting, this is off by default

2) Sandboxing, this requires a sandbox licence and is not enableable

No rules applying to this mail prevent virus scan that I can tell, or am I being stupid ?

Jeff
Cancel
Vote Up 0 Vote Down

Cancel
JeffreyLewcock over 7 years ago in reply to JeffreyLewcock

My SMTP Settings

My Only 3 exceptions are:-
Cancel
Vote Up 0 Vote Down

Cancel
rfcat_vk over 7 years ago in reply to JeffreyLewcock

I have to admit, I am now in over my head and need a mail expert to review your log file.

To me there seems many items there that raise flags with that site that somewhere there is a an exclusion list for this site.

XG115W - v20 GA - Home

XG on VM 8 - v20 GA

If a post solves your question please use the 'Verify Answer' button.
Cancel
Vote Up 0 Vote Down

Cancel
JeffreyLewcock over 7 years ago in reply to rfcat_vk

Thanks anyway rfcat, at least it made me review my setup with care !

I sent a set of test emails from here http://www.emailsecuritycheck.net

Emails 1 and 2 were correctly dropped at SMTP transaction (Email 1 is confirmed spam, Email 2 contains EICAR-AV-Test)

Emails 3-7 were quarantined correctly

So it would appear that there is something about the Malware (Troj/DocDl-HKN) that gets missed, Thats not good !

Jeff
Cancel
Vote Up 0 Vote Down

Cancel
BAlfson over 7 years ago in reply to JeffreyLewcock

Jeff, I agree that this looks suspiciously like an undocumented feature. Please get Sophos Support involved so that the developers can make sure that AV is run on messages released from Quarantine.

Cheers - Bob

Sophos UTM Community Moderator
Sophos Certified Architect - UTM
Sophos Certified Engineer - XG
Gold Solution Partner since 2005

MediaSoft, Inc. USA
Cancel
Vote Up 0 Vote Down

Cancel
JeffreyLewcock over 7 years ago in reply to BAlfson

Thanks Bob,

That was a serious bit of mind reading I was just thinking will anyone else reply when the notification came in !! Weird

Anyway I'm a home user so I don't think I can get support can i ?

Jeff
Cancel
Vote Up 0 Vote Down

Cancel
BAlfson over 7 years ago in reply to JeffreyLewcock

You have a PM from me, Jeff, asking you to turn off scanning outbound momentarily so that you can send that to me.

Cheers - Bob

Sophos UTM Community Moderator
Sophos Certified Architect - UTM
Sophos Certified Engineer - XG
Gold Solution Partner since 2005

MediaSoft, Inc. USA
Cancel
Vote Up 0 Vote Down

Cancel