SAVI best practices?
Bill Earle <[email protected]>
| Newsgroups | gmane.comp.security.virus.vtools |
|---|---|
| Message-ID | <[email protected]> |
Sophos Support,
my inital incident no: EDA-19-EMR
incident no.: EAA-19-QPG
mgd asked for an e-mail that he can forward along to the SAVI
developers that details the problem.
We are having difficulty properly identifying viruses and have
seen differences between sweep and sophie behavior.
Since my naive understanding is that sweep and sophie are simply
different interfaces to the SAVI library and they produce different
results when scanning the same file, there must be differences in
way they call the SAVI library. From what I can gather is that
the different "ways" of calling the SAVI libraries is determined
by the configuration parameters. There are 2 ways to approach this
from an end-user's perspective:
1. Have a commandline option to sweep to print out the settings
of the configuration options and allow us to see the settings.
Then we can compare our settings and make adjustments as necessary.
- sophie has such a commandline option "-c". (see the output below)
2. Have the developers of the SAVI libraries document and provide
a best proctices recommendation of configuration options and
settings for maximum effectiveness for virus detection.
- also a best practices recommendation for commandline options
for using sweep.
- The idea is to use the proper settings to allow us to make
an authorative determination if a mail message contains a
virus or not. We get 3 responses from Sophie / SAVI and perform
different operations based on those responses.
1 - positively identified the existance of a virus
- we do not allow the file into our network.
0 - positively determined that no known virus is contained
in the message
- we happily forward the message along
-1 - undetermined if a vrus exits or not
- we encapsulate the original message inside another
message with a warning and pass it along.
In this specific case we have been told that the if we run
sweep without "-mime" we can determine the delivery method is
Sefex-A, but do not see the payload is Tofger-H. My output
indicates that sophie has "Mime" set to "0" and that should
be the same as sweep without "-mime", but sophie happily says
the file was not infected. sweep -mime also says the file
is not infected.
When we 1st received the sample:
- sophie says positively no virus
- "sweep -f -archive -mime" says positively no virus
- "sweep -f -archive" identifies the delivery method: Sefex-A
- "other" virus detection tools, PC based Norton AV" identifed
the delivery method: Sefex
What is the proper response?
- identify the delivery method?
- pass the file as clean?
After manually installing the tofger-h.ide file:
- sophie identifies the payload as: Tofger-H
- "sweep -f -archive" identifies the delivery method: Sefex-A
- "sweep -f -archive -mime" identifies the payload as: Tofger-H
We run an automated .ide update routine that "retires" .ide files
when Sophos removes or changes them in the .zip distributions.
Manually installed .ide files do not exist in the distribution
and are therefore "retired" and no longer used and therefore are
not a viable solution.
Our site is still running the 1.x branch of sophie and therefore,
may not be specifically setting all of the available configuration
options, and I assume they default to a sane default setting.
sample output from sophie "-c" commandline option:
--------------------------------------------------
sophie -c
Initializing : Grp* options (engine >= 2.14)
+-----------------------------------+-----+-----+
| Configuration parameter | Type|Value|
+-----------------------------------+-----+-----+
| GrpSuper | 9 | 0 |
| GrpArchiveUnpack | 9 | 1 |
| GrpSelfExtract | 9 | 1 |
| GrpExecutable | 9 | 1 |
| GrpInternet | 9 | 1 |
| GrpMSOffice | 9 | 1 |
| GrpMisc | 9 | 1 |
| GrpDisinfect | 9 | 0 |
| GrpClean | 9 | 2 |
| PEHandling | 3 | 1 |
| Emulation | 3 | 1 |
| PeEmulator | 3 | 1 |
| DynamicDecompression | 3 | 1 |
| Upx | 3 | 1 |
| ExecFileDisinfection | 3 | 1 |
| Ole2FileDisinfection | 3 | 1 |
| Elf | 3 | 1 |
| MachO | 3 | 1 |
| SfxArchives | 3 | 0 |
| ZipDecompression | 3 | 0 |
| ZipUseChd | 3 | 1 |
| ArjDecompression | 3 | 0 |
| RarDecompression | 3 | 0 |
| UueDecompression | 3 | 0 |
| GZipDecompression | 3 | 0 |
| CmzDecompression | 3 | 0 |
| MSCabinet | 3 | 0 |
| ISCabinet | 3 | 0 |
| ISCabinetFull | 3 | 1 |
| ITSS | 3 | 0 |
| TarDecompression | 3 | 0 |
| TnefAttachmentHandling | 3 | 0 |
| TnefEmbedHandling | 3 | 0 |
| Lha | 3 | 0 |
| MSCompress | 3 | 0 |
| ActiveMimeHandling | 3 | 1 |
| Pdf | 3 | 1 |
| HqxDecompression | 3 | 0 |
| MbinDecompression | 3 | 0 |
| AppleSingle | 3 | 0 |
| Bzip2 | 3 | 0 |
| Stuffit | 3 | 0 |
| LoopBackEnabled | 3 | 0 |
| OpenMacRf | 3 | 1 |
| PalmPilotHandling | 3 | 1 |
| Rtf | 3 | 1 |
| Html | 3 | 1 |
| OLE2Handling | 3 | 1 |
| WordB | 3 | 1 |
| VBA3Handling | 3 | 1 |
| VBA5Handling | 3 | 1 |
| DecompressVBA5 | 3 | 1 |
| Vba5p | 3 | 0 |
| ExcelFormulaHandling | 3 | 1 |
| ProjectHandling | 3 | 1 |
| ScrapObjectHandling | 3 | 1 |
| VisioFileHandling | 3 | 1 |
| OleDataMsoHandling | 3 | 1 |
| OleScriptHandling | 3 | 1 |
| OleRawHandling | 3 | 1 |
| SrpStreamHandling | 3 | 1 |
| Office2001Handling | 3 | 1 |
| Vba5Dir | 3 | 0 |
| PowerPointMacroHandling | 3 | 1 |
| PowerPointEmbeddedHandling | 3 | 1 |
| IgnoreTemplateBit | 3 | 1 |
| OF95DecryptHandling | 3 | 1 |
| DelVBA5Project | 3 | 1 |
| HelpHandling | 3 | 1 |
| Skip | 3 | 1 |
| Mime | 3 | 0 |
| Base64 | 3 | 0 |
| Vbe | 3 | 1 |
| OutlookExpress | 3 | 0 |
| VbFiltering | 3 | 0 |
| UTF16 | 3 | 1 |
| Java | 3 | 1 |
| Access | 3 | 1 |
| CleanJpeg | 3 | 1 |
| CleanBmp | 3 | 1 |
| CleanGif | 3 | 1 |
| CleanRiff | 3 | 1 |
| CleanTiff | 3 | 1 |
| CleanPng | 3 | 1 |
| Xml | 3 | 0 |
| FullMacroSweep | 3 | 0 |
| FullPdf | 3 | 0 |
| FullSweep | 3 | 0 |
| StorageReport | 3 | 0 |
| StorageReportAll | 3 | 0 |
| StorageDetOnly | 3 | 0 |
| DeleteAllMacros | 3 | 0 |
| UnixArchive | 3 | 0 |
| Rpm | 3 | 0 |
| MaxRecursionDepth | 2 | 16 |
| NamespaceSupport | 3 | 0 |
| VirusDataDir | 10 | /usr/local/sav |
| VirusDataName | 10 | vdl |
| IdeDir | 10 | /usr/local/sav |
| AllowPartialVirusData | 3 | 0 |
+-----------------------------------+-----+-----+
- Bill
William B. Earle Computing & Information Technology
University at Buffalo
Voice: 716.645.6580 301 Computing Center
Fax: 716.645.5972 Buffalo, NY 14260