Re: Multiple malware scanners

On Wed, 18 Aug 2004, Tom Kistner wrote:

| deny message = Sophos detected virus ($malware_name)
|       set acl_m0 = sophie
|       malware = *
|
| deny message = ClamAV detected virus ($malware_name)
|       set acl_m0 = clamd
|       malware = *

Sounds good.

..it may even help, and even better, keep some PHBs happy.

However, I'm sorry to bring the bad news folks, but it won't solve the
fundamental problem with signature-based virus-scanning - viruses will
*always* arrive before the updated signatures.

Here we block most dangerous filetypes outright.  However, we allow .zip
files and hence we're vulnerable to .zip viruses that arrive before the AV
updates.

Not sure what the answer is.  Some have suggested a form of greylisting
whereby such mails are delayed for an interval hopefully long enough to
allow AV updates to appear.

Right now, we're trying a _very_ dirty hack where our log-watcher script
notices a sudden upturn in influx rate, and temporarily switches the
"policy" on zip mails from "pass" to "quarantine".  Next morning we check
a signature has been received and craft our own recipe if not.  Then we
release any genuine mails caught up.

Clearly, this misses the first few of an outbreak, but has saved our bacon
on a couple of occasions in recent weeks.  Nevertheless, its a dirty hack...


--
Chris Edwards, Glasgow University Computing Service