Re: Multiple malware scanners

Chris Edwards said:
> On Wed, 18 Aug 2004, Tom Kistner wrote:
>
> | deny message = Sophos detected virus ($malware_name)
> |       set acl_m0 = sophie
> |       malware = *
> |
> | deny message = ClamAV detected virus ($malware_name)
> |       set acl_m0 = clamd
> |       malware = *
>
> Sounds good.
>
> ..it may even help, and even better, keep some PHBs happy.
>
> However, I'm sorry to bring the bad news folks, but it won't solve the
> fundamental problem with signature-based virus-scanning - viruses will
> *always* arrive before the updated signatures.

Of course. But every extra step you take increases the chance of trapping
any given new outbreak quickly.

> Here we block most dangerous filetypes outright.

Likewise.

> However, we allow .zip
> files and hence we're vulnerable to .zip viruses that arrive before the AV
> updates.

Also likewise.

> Not sure what the answer is.  Some have suggested a form of greylisting
> whereby such mails are delayed for an interval hopefully long enough to
> allow AV updates to appear.

That's a good one - I don't believe it needs anything other than
'standard' greylisting, though - on the assumption that a new instance of
a new virus will arrive with new Originiating-IP/Sender/Recipient
combinations, they'll get greylisted anyway, and a single greylist defer
is enough to get rid of one instance.

> Right now, we're trying a _very_ dirty hack where our log-watcher script
> notices a sudden upturn in influx rate, and temporarily switches the
> "policy" on zip mails from "pass" to "quarantine".  Next morning we check
> a signature has been received and craft our own recipe if not.  Then we
> release any genuine mails caught up.

All measures are 'dirty' in that they circumvent features of a
well-established protocol...

Peter