XG 18.04 MR-4 more malware in emails missed even with Sandstorm now enabled!

Another virus missed by XG SAV and Sandstorm.

Detection by Puremessage behind the XG with outdated definitions:

Event: Virus infection detected

Location: 1035 Purchase Contract.rar

Replaced with text: Yes

Virus name(s): CXmail/MalPE-BP

I have uploaded this one to the support portal case also

Hello Fred,

Thank you for contacting the Sophos Community.

I was able to find the Samples submitted via the Web Site under Case ID 03741758, I took the samples and made the submissions to Labs, and I raised a Labs request with them.

I have left a note in your case, for the engineer, once there is an update from Labs, I will ask the engineer to share it with you. 

In the future, after you submit the samples, share the Case ID  that gets automatically created via the Sample Submission website, in the ticket, so the engineer can open the ticket with Labs using that Case ID, just as you mentioned in the last email.

Regards,

Hello Fred,

An update from Labs.

There’s a detection for all the samples, except for 2 which are recently created, they’ll be published in the next IDE update.

Regards,

Emmanuel,

Puremessage for Exchange retired as of December 31th but still detects them but XG with Sandbox does not. This tells me that there is something not right with your answer. 

Are you saying that Puremessage and SAV are using different virus definitions as compared to XG and Sandstorm? It is supposed to have a dual scan engine. I can send more samples that are detected by Puremessage proving the old product to be superior over XG and Sandstorm.

After moving to newer instances of Exchange and Windows server we will return to Puremessage.

Fred

The same .eml files I uploaded as samples with the new case 03741758 were also uploaded before on the request of the engineer to the old case 03694098 in the support portal. 

I mailed some of the files missed by the XG SAV and send them through the Sophos Email Gateway.  The Email Gateway does recognize these files as malicious but to be honest I uploaded those 10 files as samples before. 

I will wait for a new one to arrive in the XG and send that tru the email gateway for a conclusion.    

Are you using V18 and can look at the sandstorm reports? 

Hi LuCar Toni,

XG 18.0.4 MR-4 latest version. No new firmware available. Allowed automatic installation of hot fixes.

Set to automatic update of patterns and check every 2 hours. 

I occasionaly receive an email from the XG that malware has been caught. 

Sandstorm is in IMHO a farce. 

I have 1 file to look at the Sandstorm report and that was a harmless Excel file. They let pass by .cab. zip. .rar without any report in Sandbox during that same period.

Support is not responding. 

That is why I am checking out Email Gateway as an alternative.

I noticed that the XG will allow SMTP on all IP adresses. Our official MX is an allias. I cannot block the traffic on the IP of the XG as system takes precedence over the firewall rules. SMTP on a non MX IP address record is per definition suspicious. When I enable route incoming email through the gateway (enable setting) I end up again with mail stuck in the mail spool without being able to release. 

The email checked by Sandstorm was send to our MX ip address, the alias. Real nice fancy report. A shame it misses the important stuff.

Regards,

Fred

Firewall rules have scan SMTP and SMTPS enabled and I can see that they are hit in the log. 

You should be able to look at all sandstorm scanned Emails/files. Means you should be able to verify, why sandstorm allowed this file. If sandstorm did not generate a report for a file, it did not upload nor checked it with hash values. Which means it seems like not be getting activated by XG for whatever reason. XG will generate a report for each file - even if "only" the on prem scanner tells XG to block/allow this file. 

You do not need a firewall rule to scan SMTP. the MTA will be acting on the configuration based on the device access configuration in administration. As device access allow the zone "WAN", you can disable SMTP on the other WAN IPs/ports via Backhole DNAT rule. 

Anyways Central Email is by far the better solution with much more features to protect the setup of a costumer.