Mail scanner does not detect incoming Malware.

Hi,

what you haven't told us is your incoming mail setup.

Do you use imap because the UTM doesn't scan imap currently only smtp and pop3.

The malware would have been caught on the wayout by the smtp scanning.

Please put ina feature request for imap scanning.

Sorry,

Came in via SMTP Proxy

Was marked as spam, when I released it and forwarded I got the message.

Log:

/var/log/smtp/2017/02/smtp-2017-02-15.log.gz:2017:02:15-13:50:51 firewall exim-in[7784]: 2017-02-15 13:50:51 H=(hmrcg0v.co.uk) [146.20.65.136]:54525 Warning: jimbojones.com profile excludes greylisting: Skipping greylisting for this message
/var/log/smtp/2017/02/smtp-2017-02-15.log.gz:2017:02:15-13:50:51 firewall exim-in[7784]: 2017-02-15 13:50:51 H=(hmrcg0v.co.uk) [146.20.65.136]:54525 Warning: jimbojones.com profile excludes SANDBOX scan
/var/log/smtp/2017/02/smtp-2017-02-15.log.gz:2017:02:15-13:50:52 firewall exim-in[7784]: 2017-02-15 13:50:52 [146.20.65.136] F=<service-jimbo=jimbojones.com@hmrcg0v.co.uk> R=<jimbo@jimbojones.com> Verifying recipient address with callout
/var/log/smtp/2017/02/smtp-2017-02-15.log.gz:2017:02:15-13:51:13 firewall exim-in[7784]: 2017-02-15 13:51:13 1cdzyu-00021Y-1J DKIM: d=hmrcg0v.co.uk s=key c=relaxed/relaxed a=rsa-sha1 [invalid - public key record (currently?) unavailable]
/var/log/smtp/2017/02/smtp-2017-02-15.log.gz:2017:02:15-13:51:14 firewall exim-in[7784]: 2017-02-15 13:51:14 1cdzyu-00021Y-1J <= service-jimbo=jimbojones.com@hmrcg0v.co.uk H=(hmrcg0v.co.uk) [146.20.65.136]:54525 P=esmtp S=146907 id=0.0.0.0.1D287917DA14CAC.1AC5FEA0@hmrcg0v.co.uk
/var/log/smtp/2017/02/smtp-2017-02-15.log.gz:2017:02:15-13:51:14 firewall exim-in[7784]: 2017-02-15 13:51:14 SMTP connection from (hmrcg0v.co.uk) [146.20.65.136]:54525 closed by QUIT
/var/log/smtp/2017/02/smtp-2017-02-15.log.gz:2017:02:15-13:51:20 firewall smtpd[7932]: SCANNER[7932]: 1cdzzM-00023w-Dv <= service-jimbo=jimbojones.com@hmrcg0v.co.uk R=1cdzyu-00021Y-1J P=INPUT S=145531
/var/log/smtp/2017/02/smtp-2017-02-15.log.gz:2017:02:15-13:51:20 firewall smtpd[7932]: SCANNER[7932]: id="1001" severity="info" sys="SecureMail" sub="smtp" name="email quarantined" srcip="146.20.65.136" from="service-jimbo=jimbojones.com@hmrcg0v.co.uk" to="jimbo@jimbojones.com" subject="HMRC Secure Communication" queueid="1cdzzM-00023w-Dv" size="145531" reason="as" extra=""
/var/log/smtp/2017/02/smtp-2017-02-15.log.gz:2017:02:15-23:03:00 firewall exim-out[8786]: 2017-02-15 23:03:00 1cdzzM-00023w-Dv => jimbo@jimbojones.com P=<service-jimbo=jimbojones.com@hmrcg0v.co.uk> R=static_route_hostlist T=static_smtp H=My.LAN.IP.2 [My.LAN.IP.2]:25 C="250 2.0.0 Ok: queued as 929496086CE0"

Hi Jeff,

please read the log extracts you pasted, there are exceptions reported all through them.

If you can track down who created the exceptions in the source yuo use as a reference you will more than likely find who is trying to access your network.

Hi Rfcat

I have checked my seting again and found nothing that excludes virus (Malware) scanning.

I can only see two exclusions in the log I posted

1) Greylisting, this is off by default

2) Sandboxing, this requires a sandbox licence and is not enableable

No rules applying to this mail prevent virus scan that I can tell, or am I being stupid ?

Jeff

My SMTP Settings

My Only 3 exceptions are:-

I have to admit, I am now in over my head and need a mail expert to review your log file.

To me there seems many items there that raise flags with that site that somewhere there is a an exclusion list for this site.

Thanks anyway rfcat, at least it made me review my setup with care !

I sent a set of test emails from here http://www.emailsecuritycheck.net

Emails 1 and 2 were correctly dropped at SMTP transaction (Email 1 is confirmed spam, Email 2 contains EICAR-AV-Test)

Emails 3-7 were quarantined correctly

So it would appear that there is something about the Malware (Troj/DocDl-HKN) that gets missed, Thats not good !

Jeff

Jeff, I agree that this looks suspiciously like an undocumented feature.  Please get Sophos Support involved so that the developers can make sure that AV is run on messages released from Quarantine.

Cheers - Bob

Thanks Bob,

That was a serious bit of mind reading I was just thinking will anyone else reply when the notification came in !! Weird

Anyway I'm a home user so I don't think I can get support can i ?

Jeff

You have a PM from me, Jeff, asking you to turn off scanning outbound momentarily so that you can send that to me.

Cheers - Bob

OK Thanks Bob

I will do that

Jeff

Thanks, Jeff, but the mystery deepens...  It wasn't found to have a virus by either Avira or Sophos AV by our SMTP Proxy.  I'm hesitant to open the Word document as it contains an encrypted file.

I'm sure they'd rather have this reported by you: Submitting samples of suspicious files to Sophos

Cheers Bob

Thanks, Jeff, but the mystery deepens...  It wasn't found to have a virus by either Avira or Sophos AV by our SMTP Proxy.  I'm hesitant to open the Word document as it contains an encrypted file.

I'm sure they'd rather have this reported by you: Submitting samples of suspicious files to Sophos

Cheers Bob

Thanks Bob,

No don't its not worth the risk !

The weird thing is detecting it outbound !

I will send the sample

Jeff

Hi Bob, run the file through virustotal.com to see which scanners detect it and why even avira is missing it. Although sophos AV is intercepting the outbound mail as virus, in my experience avira has a much higher detection rate.

Hi Billybob

Sophos AV detects it on my desktop, I had to disable on Access AV scanning temporarily to upload it to Sophos

Aha, I get it now. Are you using endpoint protection or a standalone subscription. In either case a virustotal.com test will still be interesting even if it is a false positive.

Hi Billybob

I use Endpoint protection that is provided free with UTM 9, the mail proxy is handled by the UTM but I had to save the file from the email in order to submit to sophos, this is when endpoint kicked in. so I disabled OAS sent the sample deleted and re enabled OAS

Jeff

Thats ok. I remember when endpoint protection was first introduced, wingman did a lot of tests for endpoint protection vs UTM protection and he found results similar to yours. Some of the problems were fixed after his discoveries but sadly, now I see the quality of UTM detection is slipping again[:@] In any case thanks for the heads up.

Edit: A false positive; which was my first inclination. Have taken out sophos bashing after Bob's findings below[:D]

UTM Endpoint on my laptop did not see anything bad, nor did virustotal.

Cheers - Bob

Thanks for taking the time Bob. I don't know what we would do without you[:D] I have edited my post above accordingly[;)]

Hi Bob and Billybob,

Thanks for the help but am a bit confused

Are you saying this is a false positive that has been detected by both OAS and outgoing mail scanner ?

Jeff

I don't know, Jeff.  I don't understand what happened to cleanse the message when it was forwarded to me, but that appears to be what happened.  Very strange.

Cheers - Bob