Same question again : Chrome don't open malicious links due to labeling them dangerous as per "Safebrowsing". Then why ClamAV is not able to identify such malicious links when "Safebrowsing" option is already enabled ??
On Sat, Dec 8, 2018 at 9:00 PM Micah Snyder (micasnyd) <micas...@cisco.com> wrote: > Our replies may be getting filtered by your email provider because you > included a malicious link in the email chain. :D I removed the link from > this reply. > > > Micah Snyder > ClamAV Development > Talos > Cisco Systems, Inc. > > > On Dec 8, 2018, at 9:17 AM, Sunny Marwah <sunnymar...@trepup.com> wrote: > > > Still no reply on this matter. > > On Fri, Dec 7, 2018 at 6:17 PM Sunny Marwah <sunnymar...@trepup.com> > wrote: > >> Hi Al Varnell, >> >> Below is the URL which was mentioned in HTML template : >> >> >> Chrome don't open it due to labeling it dangerous in as per >> "Safebrowsing". Then why ClamAV is not able to identify when "Safebrowsing" >> option is already enabled ?? >> >> Looking to hear from you on this. >> >> Regards >> Sunny >> >> On Fri, Dec 7, 2018 at 5:50 PM Al Varnell <alvarn...@mac.com> wrote: >> >>> If you won't provide the URL to the rest of us users, then we can't help >>> you. You'll have to wait to see if the development team gets back to you. >>> >>> -Al- >>> >>> On Fri, Dec 07, 2018 at 04:10 AM, Sunny Marwah wrote: >>> >>> Hi Al Varnell, >>> >>> I have already gone through >>> https://www.clamav.net/documents/safebrowsing. >>> >>> That URL i have already shared with one of ClamAV development team >>> members >>> >>> I did not understand your point what you said --- "You will probably >>> need to obfuscate it in order to get it through the mail system, something >>> like httx://....". >>> >>> My purpose behind using ClamAV is to scan Linux server and plus HTML >>> templates which we regularly receive on server. >>> >>> And the reason behind using "Safebrowing" option is to detect deceptive, >>> Phishing URL's in HTML templates in the same way as Chrome warns us before >>> opening such URL's. I want ClamAV to detect such files as "Infected" which >>> contain deceptive, Phishing URL's. >>> >>> Waiting for your quick and needful response. >>> >>> Regards >>> Sunny >>> >>> On Fri, Dec 7, 2018 at 5:22 PM Al Varnell <alvarn...@mac.com> wrote: >>> >>>> Have your read the explanation at < >>>> https://www.clamav.net/documents/safebrowsing>? >>>> >>>> Please provide the phishing URL that is failing. You will probably need >>>> to obfuscate it in order to get it through the mail system, something like >>>> httx://.... >>>> >>>> -Al- >>>> >>>> On Fri, Dec 07, 2018 at 03:17 AM, Sunny Marwah wrote: >>>> >>>> Hello Micah & Team, >>>> >>>> Have not received any response on my last email. >>>> >>>> Also, i have enabled Safebrowsing option in freshclam.conf as suggested >>>> by you. >>>> >>>> Still i can see that ClamAV is not working properly. There is one file >>>> placed on server and there is one phishing URL available in that file. That >>>> URL is so deceptive that Chrome is not letting us open that URL due to >>>> labeling it as "Deceptive" URL. >>>> >>>> Why ClamAV is still not able to find that file as "Infected" in >>>> scanning even after enabling "Safebrowsing" option ?? >>>> >>>> Waiting for your quick and needful response. >>>> >>>> Regards >>>> Sunny >>>> >>>> On Thu, Dec 6, 2018 at 4:41 PM Sunny Marwah <sunnymar...@trepup.com> >>>> wrote: >>>> >>>>> Hi Micah, >>>>> >>>>> Thanks for letting me know about enabling SafeBrowsing CVD option in >>>>> ClamAV. >>>>> >>>>> Google safe browsing put a website in 3 categories mentioned below : >>>>> 1 Secure >>>>> 2 Info or Not secure >>>>> 3 Not secure or Dangerous >>>>> >>>>> Curious to know how ClamAV will categorize the HTML file. Let's say, >>>>> if any "Note secure or Dangerous" URL is found, will ClamAV will show it >>>>> as >>>>> infected file in scanning summary ? If this is the case, i guess in case >>>>> "Secure" URL is found, it will show as OK. And what if URL is found as >>>>> "Info or Not secure" ? >>>>> >>>>> Regards >>>>> Sunny >>>>> >>>>> >>>>> On Thu, Dec 6, 2018 at 3:19 PM Micah Snyder (micasnyd) < >>>>> micas...@cisco.com> wrote: >>>>> >>>>>> It may be worth mentioning that in addition to the [optional] >>>>>> SafeBrowsing CVD that you can choose to include, ClamAV has just started >>>>>> including PhishTank signatures late last month. >>>>>> >>>>>> For those who curious, see https://lists.gt.net/clamav/virusdb/. >>>>>> PhishTank signatures are prefixed with Phishtank.Phishing. >>>>>> >>>>>> >>>>>> Micah Snyder >>>>>> ClamAV Development >>>>>> Talos >>>>>> Cisco Systems, Inc. >>>>>> >>>>>> >>>>>> On Dec 6, 2018, at 3:27 AM, Al Varnell <alvarn...@mac.com> wrote: >>>>>> >>>>>> Frankly, I'm surprised that ClamAV finds any such URL's. They are way >>>>>> to dynamic (blacklisted one day and removed the next). ClamAV does >>>>>> malware >>>>>> detection over the long haul and trying to keep up with fraudulent web >>>>>> sites would be a full time job and better done by other means (e.g. >>>>>> Google >>>>>> Safe Browsing). >>>>>> >>>>>> -Al- >>>>>> >>>>>> On Wed, Dec 05, 2018 at 11:33 PM, Sunny Marwah wrote: >>>>>> >>>>>> Hello Team, >>>>>> >>>>>> We are using clamav-0.100.2 to scan few HTML email templates. >>>>>> >>>>>> Sometimes, there are deceptive URL's mentioned in those templates and >>>>>> that template should be detected as infected via ClamAV scan process. >>>>>> >>>>>> I can see weird output of ClamAV scan process. Sometimes it detect >>>>>> such templates as infected and sometimes, it does not detect them as >>>>>> infected. And the URL's i am talking about, are so deceptive that even >>>>>> Google chrome browser don't let us open these URL's and show us clear >>>>>> warning as "Dangerous" about deceptive website. >>>>>> >>>>>> Can you put your views behind such unpredictable behavior ? >>>>>> >>>>>> If you want then i can report such URL's on your malware link for >>>>>> reporting. >>>>>> >>>>>> Regards >>>>>> Sunny >>>>>> >>>>>> _______________________________________________ >>>>>> clamav-users mailing list >>>>>> clamav-users@lists.clamav.net >>>>>> http://lists.clamav.net/cgi-bin/mailman/listinfo/clamav-users >>>>>> >>>>>> >>>>>> Help us build a comprehensive ClamAV guide: >>>>>> https://github.com/vrtadmin/clamav-faq >>>>>> >>>>>> http://www.clamav.net/contact.html#ml >>>>>> >>>>>> >>>>>> _______________________________________________ >>>>>> clamav-users mailing list >>>>>> clamav-users@lists.clamav.net >>>>>> http://lists.clamav.net/cgi-bin/mailman/listinfo/clamav-users >>>>>> >>>>>> >>>>>> Help us build a comprehensive ClamAV guide: >>>>>> https://github.com/vrtadmin/clamav-faq >>>>>> >>>>>> http://www.clamav.net/contact.html#ml >>>>>> >>>>> >>>>> >>>>> -- >>>>> Regards >>>>> Sunny >>>>> System Engineer >>>>> Mob : +91 9711155549 >>>>> >>>> >>>> -Al- >>>> -- >>>> Al Varnell >>>> Mountain View, CA >>>> >>>> >>>> >>>> >>>> >>>> _______________________________________________ >>>> clamav-users mailing list >>>> clamav-users@lists.clamav.net >>>> http://lists.clamav.net/cgi-bin/mailman/listinfo/clamav-users >>>> >>>> >>>> Help us build a comprehensive ClamAV guide: >>>> https://github.com/vrtadmin/clamav-faq >>>> >>>> http://www.clamav.net/contact.html#ml >>> >>> >>> -Al- >>> -- >>> Al Varnell >>> Mountain View, CA >>> >>> >>> >>> >>> >>> _______________________________________________ >>> clamav-users mailing list >>> clamav-users@lists.clamav.net >>> http://lists.clamav.net/cgi-bin/mailman/listinfo/clamav-users >>> >>> >>> Help us build a comprehensive ClamAV guide: >>> https://github.com/vrtadmin/clamav-faq >>> >>> http://www.clamav.net/contact.html#ml >>> >> >> >> -- >> Regards >> Sunny >> System Engineer >> Mob : +91 9711155549 >> >> > > -- > Regards > Sunny > System Engineer > Mob : +91 9711155549 <+91%209711155549> > > _______________________________________________ > clamav-users mailing list > clamav-users@lists.clamav.net > http://lists.clamav.net/cgi-bin/mailman/listinfo/clamav-users > > > Help us build a comprehensive ClamAV guide: > https://github.com/vrtadmin/clamav-faq > > http://www.clamav.net/contact.html#ml > > > _______________________________________________ > clamav-users mailing list > clamav-users@lists.clamav.net > http://lists.clamav.net/cgi-bin/mailman/listinfo/clamav-users > > > Help us build a comprehensive ClamAV guide: > https://github.com/vrtadmin/clamav-faq > > http://www.clamav.net/contact.html#ml > -- Regards Sunny System Engineer Mob : +91 9711155549
_______________________________________________ clamav-users mailing list clamav-users@lists.clamav.net http://lists.clamav.net/cgi-bin/mailman/listinfo/clamav-users Help us build a comprehensive ClamAV guide: https://github.com/vrtadmin/clamav-faq http://www.clamav.net/contact.html#ml
