Email Security Testing Zone

rusticdog · Posted: Wed Aug 27, 2003 10:46 pm Post subject: Email Security Testing Zone

Is your email system secure against email viruses and attacks?
The most deadly viruses, able to cripple your email system and corporate network in minutes, are being distributed worldwide via email in a matter of hours (for example, the LoveLetter virus). Email worms and viruses can reach your system and infect your users through harmful attachments. But that's not all! Some viruses are transmitted through harmless-looking email messages and can run automatically without the need for user intervention (like the Nimda virus). Are you covered against such threats?

Find out now by doing a vulnerability check on your email system!
Sign up to test for these real world threats by entering your name and email address below. You will receive an email asking you to confirm your request by clicking on a URL, after which we will perform a vulnerability check of your email system. You will receive the results by email.

http://www.gfi.com/emailsecuritytest/

Mariner · Posted: Thu Aug 28, 2003 11:07 am Post subject: e-mail security test

is this test for the ordinary, home PC user or, just for companies?

would like to try it but concerned about possible exploit if l have vulnerabilities.

cheers

Mariner

TimeGhost · Captain Joined: Apr 11, 2003 Posts: 650 Location: USA

This forum is rather a strange place to post the exploit test?

Anyway, it should be interesting to see what happens....

TimeGhost · Captain Joined: Apr 11, 2003 Posts: 650 Location: USA

Here's the setup:

I instructed the test to hit my personal email account, which I access from the LAN at work from behind a Cisco router and firewall. I'm running Outlook 2000 in CW mode, with additional Internet Email services to access my ISP's POP3 server. Outlook actually sends requests for message downloads to B9 v1.41, which in turn, sends it to K9 v1.12, which goes up against the mail server. As well, MWP v3.1 is used to screen mail on the server. Finally, my address is an alias, which is virus scanned and then relayed to the mail server.

I first used MWP to download the headers, which it did easily. But the DNS blacklist check took about 30 minutes to complete. (Did the company FW throttle MWP?) MWP's hueristics did not flag the messages in any way. The spam throttle is set to Fast (20 lines). None of Gary's filters fired, either.

After the DNS blacklist test was complete, I checked for new messages, and then I used Outlook to download the messages, without processing any mail. K9 did not flag any of the messages as spam. The highest spam probability was 9.4% for the Access exploit.

The Eicar_test_file was caught by the server anti-virus, and I received the five fragmented messages, which B9 left unchanged. B9 (running the default medium security profile) reported changes to all the other messages.

I opened each mesage in Outlook, and did not experience any of the results of the exploits.

Finally, I opened each message using MWP. Then (after the entire messages were downloaded) I received the following statuses:

MIME header: Virus, Delete
CLSID (both): Possible Virus, Delete
malformed file extension: Possible Virus, Delete
VBS attachment: Possible Virus

rusticdog · Posted: Sun Aug 31, 2003 9:28 pm Post subject:

Wayward · Posted: Mon Sep 01, 2003 12:12 am Post subject:

rusticdog,

Thanks for the link to these tests. Interesting and informative. Some combination of MWP, Benign, Zone Alarm Pro, an antivirus program, and my ISP's use of MIMEDefang took care of most of the stuff. And, naturally, I didn't understand some of what was going on. Wink

Guest · Posted: Fri Oct 17, 2003 10:06 am Post subject:

mcullet · Posted: Wed Feb 11, 2004 5:42 pm Post subject:

TimeGhost · Captain Joined: Apr 11, 2003 Posts: 650 Location: USA


	Home ˇ Topics ˇ Submit News ˇ Top 10 This entire site, Cops Themes, and Computer Cops are Š 2002 - 2004 Computer Cops, LLC. All rights reserved. You can syndicate our news using the file RSS 0.91, ultramode.txt, or RSS 1.0. Acceptable Use Policy. Use signifies your agreement. Engine Copyright Š 2002 by PHP-Nuke, GNU/GPL Licensed. ICRA Member. Paul Laudanski, Member of Computer Cops, LLC Server Load: 1497 pages served in previous 5 minutes. Page Rendered: 0.500 seconds.