This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Mail Protection from Malicious file under Zip.

Hello team due to lack of this zip file scan and block malicious file feature in sophos UTM we have faced very huge damage in our LAN network where some one has sent us an email with malicious JavaScript file inside Zip file. May i know when or what is expected date that we can scan and block malicious or virus infected file which we receive some time through email as Zip attachment.



This thread was automatically locked due to age.
Parents Reply Children
  • Hello Sachin, i have gone through multiple time on above article which has release on the date of 10-11-2014 where under "Other New Features" column article says "True-File-Type Detection: In our web and mail proxy we now traverse archive files (zip, rar, etc.) to detect the types of files inside. This allows granular policy enforcement based on file types included in an archive rather than blocking archive files in general" but requesting  you that kindly go through below Sophos article which is on going "https://community.sophos.com/products/unified-threat-management/f/56/t/15972" and one of your Sophos team member has commented on the date "

     Replied: 10 Dec 2015 3:24 PM" that still this issue has been not resolved and still this article is open as you can check on 2nd page of this article where user has commented on 16/March/2016.

    From your end i just want that if this is possible with version 9.3xx than kindly provide us the doc or ref. link using which we can achieve this requirement.


     

  • Hi Aizaz,

    This feature is UP and running as per the latest update I received. Request  you to check the residing Pattern and Firmware version in your UTM. Please update if required.

    Next I also request you to use Dual Scan which can be found by navigating through Email Protection > SMTP> Anti Virus > Antivirus Scanning> Dual Scan. Also select the "Quarantine unscannable and encrypted content" option for better protection.

    Note: password protected zip file cannot be prevented. 

    I also request you to check if any exceptions are configured in Email protection for AntiVirus checking. 

    Hope this helps :)

    Thanks

    Sachin Gurung

    Sachin Gurung
    Team Lead | Sophos Technical Support
    Knowledge Base  |  @SophosSupport  |  Video tutorials
    Remember to like a post.  If a post (on a question thread) solves your question use the 'This helped me' link.

  • Although I haven't personally tried these experiments, Sachin, I've seen this issue come up here many times over the years.  I believe that what we have now is the ability to quarantine MIME types as opposed to file extensions in non-encrypted archives (not just zip).  If you can run an experiment in your lab, please let us know the result.

    Cheers - Bob

     
    Sophos UTM Community Moderator
    Sophos Certified Architect - UTM
    Sophos Certified Engineer - XG
    Gold Solution Partner since 2005
    MediaSoft, Inc. USA
  • Hi Balfson,

    Yes, we have the ability to quarantine MIME types. Again protection against malicious files under ZIP is working, there can be False Negatives at time, which should be reported to our Support Team, who can forward the sample for further testing.

    Thanks

    Sachin Gurung

    Sachin Gurung
    Team Lead | Sophos Technical Support
    Knowledge Base  |  @SophosSupport  |  Video tutorials
    Remember to like a post.  If a post (on a question thread) solves your question use the 'This helped me' link.

  • Sachin, please get proof from the devs that this works today.  It may have worked at one time, but I haven't seen or heard of it working in several years.  Have you seen it done?

    Cheers - Bob

     
    Sophos UTM Community Moderator
    Sophos Certified Architect - UTM
    Sophos Certified Engineer - XG
    Gold Solution Partner since 2005
    MediaSoft, Inc. USA