This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Mail scanner does not detect incoming Malware.

I recieved a phishing email with an attachment, the mail was classed as spam and quarantined.

I released the mail from quarantine and once I was sure it was a phising email I forwarded it to the security department at the organisation it perported to come from.

I immeadiately got a bounce from my UTM that the mail had a malware attachment !!

"Your message to the following recipients was quarantined:

<phishing@hmrc.gsi.gov.uk>, quarantine reason: Malware (Troj/DocDl-HKN)

Please contact your IT administrator for further assistance."


This means that the scanner missed it on the way in !
I have no whitelisting to prevent any antivirus scanning and use dual scan.

UTM v9.411-3

This would appear as a rather severe bug

Jeff

This thread was automatically locked due to age.

JeffreyLewcock over 7 years ago in reply to BAlfson

Thanks Bob,

That was a serious bit of mind reading I was just thinking will anyone else reply when the notification came in !! Weird

Anyway I'm a home user so I don't think I can get support can i ?

Jeff
Cancel
Vote Up 0 Vote Down

Cancel
BAlfson over 7 years ago in reply to JeffreyLewcock

You have a PM from me, Jeff, asking you to turn off scanning outbound momentarily so that you can send that to me.

Cheers - Bob

Sophos UTM Community Moderator
Sophos Certified Architect - UTM
Sophos Certified Engineer - XG
Gold Solution Partner since 2005

MediaSoft, Inc. USA
Cancel
Vote Up 0 Vote Down

Cancel
JeffreyLewcock over 7 years ago in reply to BAlfson

OK Thanks Bob

I will do that

Jeff
Cancel
Vote Up 0 Vote Down

Cancel
BAlfson over 7 years ago in reply to JeffreyLewcock

Thanks, Jeff, but the mystery deepens... It wasn't found to have a virus by either Avira or Sophos AV by our SMTP Proxy. I'm hesitant to open the Word document as it contains an encrypted file.

I'm sure they'd rather have this reported by you: Submitting samples of suspicious files to Sophos

Cheers Bob

Sophos UTM Community Moderator
Sophos Certified Architect - UTM
Sophos Certified Engineer - XG
Gold Solution Partner since 2005

MediaSoft, Inc. USA
Cancel
Vote Up 0 Vote Down

Cancel
JeffreyLewcock over 7 years ago in reply to BAlfson

Thanks Bob,

No don't its not worth the risk !

The weird thing is detecting it outbound !

I will send the sample

Jeff
Cancel
Vote Up 0 Vote Down

Cancel
Billybob over 7 years ago in reply to BAlfson

Hi Bob, run the file through virustotal.com to see which scanners detect it and why even avira is missing it. Although sophos AV is intercepting the outbound mail as virus, in my experience avira has a much higher detection rate.
Cancel
Vote Up 0 Vote Down

Cancel
JeffreyLewcock over 7 years ago in reply to Billybob

Hi Billybob

Sophos AV detects it on my desktop, I had to disable on Access AV scanning temporarily to upload it to Sophos
Cancel
Vote Up 0 Vote Down

Cancel
Billybob over 7 years ago in reply to JeffreyLewcock

Aha, I get it now. Are you using endpoint protection or a standalone subscription. In either case a virustotal.com test will still be interesting even if it is a false positive.
Cancel
Vote Up 0 Vote Down

Cancel
JeffreyLewcock over 7 years ago in reply to JeffreyLewcock

Hi Billybob

I use Endpoint protection that is provided free with UTM 9, the mail proxy is handled by the UTM but I had to save the file from the email in order to submit to sophos, this is when endpoint kicked in. so I disabled OAS sent the sample deleted and re enabled OAS

Jeff
Cancel
Vote Up 0 Vote Down

Cancel
Billybob over 7 years ago in reply to JeffreyLewcock

Thats ok. I remember when endpoint protection was first introduced, wingman did a lot of tests for endpoint protection vs UTM protection and he found results similar to yours. Some of the problems were fixed after his discoveries but sadly, now I see the quality of UTM detection is slipping again[:@] In any case thanks for the heads up.

Edit: A false positive; which was my first inclination. Have taken out sophos bashing after Bob's findings below[:D]
Cancel
Vote Up 0 Vote Down

Cancel