This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

To less malware detected during SMTP-Scan

Hi there,
since I enabled the Software UTM (right now 9.310-11) as a SMTP-Proxy it is filtering SPAM very well - but malware not as well as expected.

During the last 30 days it blocked 11 inbound mails for malware reasons - so far, so good - but in the same time the internal Exchange with "forefront security" reported a dozen times malware detection - and was right!
But Forefront is EOL and our license period will end up next week so it will stop the protection during the next days.

Yes, of course I did set the E-Mailprotection / Antivirus to "Dual Scan (Maximum Security)".

The patterns are downloaded and installed in the background and seem to be fine.

Any ideas for a better protection out there?

This thread was automatically locked due to age.

0 Chris69 over 9 years ago

So I looked into the old logs for one of the Subject-lines ("MT103") of the bad mails being passed thru the UTM.
Here you are:

 berlin:/root # gunzip -fc /var/log/smtp/2015/04/smtp-2015-04-30.log.gz | grep -B 18 -A 18 MT103



2015:04:30-21:03:25 berlin-1 exim-in[11368]: [1\24] 2015-04-30 21:03:25 1Yntk5-0002xM-0J H=mailout07.t-online.de [194.25.134.83]:49017 F= temporarily rejected after DATA: Temporary local problem, please try again!

2015:04:30-21:03:25 berlin-1 exim-in[11368]: [2\24] Envelope-from: 

2015:04:30-21:03:25 berlin-1 exim-in[11368]: [3\24] Envelope-to: 

2015:04:30-21:03:25 berlin-1 exim-in[11368]: [4\24]     

2015:04:30-21:03:25 berlin-1 exim-in[11368]: [5\24] P Received: from mailout07.t-online.de ([194.25.134.83]:49017)

2015:04:30-21:03:25 berlin-1 exim-in[11368]: [6\24] 	by berlin.gate.XYZ.com with esmtps (TLSv1.2[[:D]]HE-RSA-AES256-GCM-SHA384:256)

2015:04:30-21:03:25 berlin-1 exim-in[11368]: [7\24] 	(Exim 4.82_1-5b7a7c0-XX)

2015:04:30-21:03:25 berlin-1 exim-in[11368]: [8\24] 	(envelope-from )

2015:04:30-21:03:25 berlin-1 exim-in[11368]: [9\24] 	id 1Yntk5-0002xM-0J; Thu, 30 Apr 2015 21:03:25 +0200

2015:04:30-21:03:25 berlin-1 exim-in[11368]: [10\24] P Received: from fwd26.aul.t-online.de (fwd26.aul.t-online.de [172.20.26.131])

2015:04:30-21:03:25 berlin-1 exim-in[11368]: [11\24] 	by mailout07.t-online.de (Postfix) with SMTP id DE8D419306B;

2015:04:30-21:03:25 berlin-1 exim-in[11368]: [12\24] 	Thu, 30 Apr 2015 21:03:23 +0200 (CEST)

2015:04:30-21:03:25 berlin-1 exim-in[11368]: [13\24] P Received: from winsvr.compasshealth.local (ZwjebyZQohXuD0iDKRCR88iDzlNbBPNtMgBJFTPu12EZMjn2vQVH-2Kt9WA6j74gY4@[72.215.248.252]) by fwd26.t-online.de

2015:04:30-21:03:25 berlin-1 exim-in[11368]: [14\24] 	with (TLSv1[[:D]]HE-RSA-AES256-SHA encrypted)

2015:04:30-21:03:25 berlin-1 exim-in[11368]: [15\24] 	esmtp id 1Yntjy-1TH8W00; Thu, 30 Apr 2015 21:03:18 +0200

2015:04:30-21:03:25 berlin-1 exim-in[11368]: [16\24]   Content-Type: multipart/mixed; boundary="===============1089096451=="

2015:04:30-21:03:25 berlin-1 exim-in[11368]: [17\24]   MIME-Version: 1.0

2015:04:30-21:03:25 berlin-1 exim-in[11368]: [18\24]   Subject: Re: SWIFT MT103

2015:04:30-21:03:25 berlin-1 exim-in[11368]: [19\24] T To: Recipients 

2015:04:30-21:03:25 berlin-1 exim-in[11368]: [20\24] F From: "Account" 

2015:04:30-21:03:25 berlin-1 exim-in[11368]: [21\24]   Date: Thu, 30 Apr 2015 13:56:50 -0500

2015:04:30-21:03:25 berlin-1 exim-in[11368]: [22\24] I Message-ID: 

2015:04:30-21:03:25 berlin-1 exim-in[11368]: [23\24]   X-ID: ZwjebyZQohXuD0iDKRCR88iDzlNbBPNtMgBJFTPu12EZMjn2vQVH-2Kt9WA6j74gY4

2015:04:30-21:03:25 berlin-1 exim-in[11368]: [24/24]   X-TOI-MSGID: d0e9e71e-7e8a-4834-833d-d540534c5780

2015:04:30-21:03:25 berlin-1 exim-in[11368]: 2015-04-30 21:03:25 SMTP connection from mailout07.t-online.de [194.25.134.83]:49017 closed by QUIT

2015:04:30-21:03:32 berlin-1 exim-in[25747]: 2015-04-30 21:03:32 SMTP connection from [A.B.C.D]:43211 (TCP/IP connection count = 1)

2015:04:30-21:03:32 berlin-1 exim-in[11374]: 2015-04-30 21:03:32 [A.B.C.D] F= R= Accepted: from relay

2015:04:30-21:03:32 berlin-1 exim-in[11374]: 2015-04-30 21:03:32 [A.B.C.D] F= R= Accepted: from relay

2015:04:30-21:03:32 berlin-1 exim-in[11374]: 2015-04-30 21:03:32 1YntkC-0002xS-0l ctasd reports 'Unknown' RefID:str=0001.0A0B0204.55427C84.016F,ss=1,re=0.000,recu=0.000,reip=0.000,cl=1,cld=1,fgs=0

2015:04:30-21:03:32 berlin-1 exim-in[11374]: 2015-04-30 21:03:32 1YntkC-0002xS-0l  work R=SCANNER T=SCANNER

2015:04:30-21:03:41 berlin-1 smtpd[11377]: SCANNER[11377]: 1YntkC-0002xS-0l Completed

2015:04:30-21:03:41 berlin-1 exim-out[11381]: 2015-04-30 21:03:41 1YntkK-0002xV-9O => "MisterX"@XYZ.com P= R=static_route_hostlist T=static_smtp H=192.168.0.174 [192.168.0.174]:25 X=TLSv1:RC4-SHA:128 C="250 2.6.0  Queued mail for delivery"

2015:04:30-21:03:41 berlin-1 exim-out[11381]: 2015-04-30 21:03:41 1YntkK-0002xV-9O Completed

2015:04:30-21:03:41 berlin-1 exim-out[11382]: 2015-04-30 21:03:41 1YntkK-0002xV-9L => info@XYZ.com P= R=static_route_hostlist T=static_smtp H=192.168.0.173 [192.168.0.173]:25 X=TLSv1:RC4-SHA:128 C="250 2.6.0  Queued mail for delivery"

2015:04:30-21:03:41 berlin-1 exim-out[11382]: 2015-04-30 21:03:41 1YntkK-0002xV-9L Completed

0 Chris69 over 9 years ago

So are there any ideas out there...?
Cancel
Vote Up 0 Vote Down

Cancel
0 William Warren over 9 years ago

have you started a ticket with support?

Owner: Emmanuel Technology Consulting

http://etc-md.com

Former Sophos SG(Astaro) advocate/researcher/Silver Partner

PfSense w/Suricata, ntopng,

Other addons to follow
Cancel
Vote Up 0 Vote Down

Cancel
0 Chris69 over 9 years ago

No, not yet.
Meanwhile I suppose: The quality of the AV scanengines is not as good as I was adjusted to and no support can do something.
Cancel
Vote Up 0 Vote Down

Cancel
0 William Warren over 9 years ago

cannot tlel you anything at this point if you have a paid subscription get support involved..could be a bug in the system.

Owner: Emmanuel Technology Consulting

http://etc-md.com

Former Sophos SG(Astaro) advocate/researcher/Silver Partner

PfSense w/Suricata, ntopng,

Other addons to follow
Cancel
Vote Up 0 Vote Down

Cancel
0 Chris69 over 9 years ago

I have paid subscription and: heck! Just right in this moment again:

Microsoft Forefront Protection for Exchange Server hat einen Virus gefunden.

    Virusname: "W32/VBTrojan.9!Maximus"
    Dateiname: "fattura-1013057821.rar->fattura-1013057821-genereted-by-system-automation-confirmed-operator.exe"
    Status: "Entfernt"
    Betreffzeile: "copia documento richiesto"

And SMTP-Log looks like this:

2015:05:13-12:18:24 berlin-1 exim-in[8601]: 2015-05-13 12:18:24 SMTP connection from [213.218.169.82]:57295 (TCP/IP connection count = 2)
2015:05:13-12:18:24 berlin-1 exim-in[1204]: 2015-05-13 12:18:24 [213.218.169.82] F= R= Accepted: from relay
2015:05:13-12:18:24 berlin-1 exim-in[1204]: 2015-05-13 12:18:24 1YsTk8-0000JQ-2I DKIM: d=info1.benacomolit.info s=default c=relaxed/relaxed a=rsa-sha256 [verification succeeded]
2015:05:13-12:18:25 berlin-1 exim-in[1204]: 2015-05-13 12:18:25 1YsTk8-0000JQ-2I ctasd reports 'Unknown' RefID:str=0001.0A0C0201.555324F1.001B,ss=1,re=0.000,recu=0.000,reip=0.000,cl=1,cld=1,fgs=0
2015:05:13-12:18:25 berlin-1 exim-in[1204]: 2015-05-13 12:18:25 1YsTk8-0000JQ-2I contact@info1.benacomolit.info H=mail.XYZ.net [213.218.169.82]:57295 P=esmtps X=TLSv1:AES256-SHA:256 S=37211 id=E1YsTjz-0001Wb-2g@info1.benacomolit.info
2015:05:13-12:18:25 berlin-1 exim-in[1204]: 2015-05-13 12:18:25 SMTP connection from mail.XYZ.net [213.218.169.82]:57295 closed by QUIT
2015:05:13-12:18:26 berlin-1 smtpd[8506]: QMGR[8506]: 1YsTk8-0000JQ-2I moved to work queue
2015:05:13-12:18:26 berlin-1 smtpd[1099]: SCANNER[1099]: 1YsTkA-0000Hj-Oy contact@info1.benacomolit.info R=1YsTk8-0000JQ-2I P=INPUT S=35618
2015:05:13-12:18:27 berlin-1 smtpd[1099]: SCANNER[1099]: id="1000" severity="info" sys="SecureMail" sub="smtp" name="email passed" srcip="213.218.169.82" from="contact@info1.benacomolit.info" to="info@XYZ.com" subject="copia documento richiesto" queueid="1YsTkA-0000Hj-Oy" size="35618"
2015:05:13-12:18:27 berlin-1 smtpd[1099]: SCANNER[1099]: 1YsTk8-0000JQ-2I => work R=SCANNER T=SCANNER
2015:05:13-12:18:27 berlin-1 smtpd[1099]: SCANNER[1099]: 1YsTk8-0000JQ-2I Completed
2015:05:13-12:18:27 berlin-1 exim-out[1207]: 2015-05-13 12:18:27 1YsTkA-0000Hj-Oy => info@XYZ.com P= R=static_route_hostlist T=static_smtp H=192.168.0.173 [192.168.0.173]:25 X=TLSv1:RC4-SHA:128 C="250 2.6.0  > Queued mail for delivery"
2015:05:13-12:18:27 berlin-1 exim-out[1207]: 2015-05-13 12:18:27 1YsTkA-0000Hj-Oy Completed
2015:05:13-12:18:56 berlin-1 smtpd[1099]: SCANNER[1099]: Nothing to do, exiting.

But it is not that the UTM does not filter mails:
today´s statistics:

Total number of malware mails: 2
Total malware mail size: 80.3 kB
Malware Name   # Traffic
TR/Kryptik.dhvz   2    80,3kB

So I will involve Sophos anyway.
Cancel
Vote Up 0 Vote Down

Cancel
0 Dread over 9 years ago

How did you go with this Chris?

Looking to tighten my SG230 down as well [;)]
Cancel
Vote Up 0 Vote Down

Cancel
0 Chris69 over 9 years ago

I did involve Sophos Support twice

The first time they just let me know, that the malware I uploaded was included into the patternfiles at the same day but 8h after the malware passes my UTM for the first time.
They did not respond to my opbjections, that the malware itself is a really old one and still passes the UTM when I bypass all other AV-Scan engines other than the UTM and send it back and forth.

Today it happened again with a really old worm - I opened up a call again and voila:

It is a Bug in the UTM, fixed in 9.312:
Mantis 34542 File extension and/or mime type check does not work in an archive.

Grrrr!
Cancel
Vote Up 0 Vote Down

Cancel
0 Chris69 over 9 years ago

I did involve Sophos Support twice

The first time they just let me know, that the malware I uploaded was included into the patternfiles at the same day but 8h after the malware passes my UTM for the first time.
They did not respond to my opbjections, that the malware itself is a really old one and still passes the UTM when I bypass all other AV-Scan engines other than the UTM and send it back and forth.

Today it happened again with a really old worm - I opened up a call again and voila:

It is a Bug in the UTM, fixed in 9.312:
Mantis 34542 File extension and/or mime type check does not work in an archive.

Grrrr!
Cancel
Vote Up 0 Vote Down

Cancel