Tag Info

New answers tagged

2

Yes. Just having a file on your hard drive does nothing. However, note that there may be potential for execution. Suppose the exploit was inside a .pdf, and opening it by a vulnerable reader results in code execution. It is possible that although you don't open it in your pdf viewer, just by opening its folder a plugin intended to create a thumbnail opens ...


3

Generally speaking, you are correct. Let's look at some exceptions: If the malware exploits a vulnerability in your email program. If the malware exploits a vulnerability in the software used to "unzip" it. If the malware exploits a vulnerability in the software used to view its contents (ie Windows Explorer). If the malware exploits a vulnerability in the ...


2

Everyone is trying to explain the arms race, which is true, but there is the very simple logic that if spamfilters were perfect, then spam would not exist anymore because it's no longer profitable. And a spambox would not exist because we are 100% sure of what is spam and what is not, so it could go straight to trash without landing in a spambox first. ...


2

OH MAN am I glad that I no longer have to deal with these. I would explain how a spam filter actually works. Generally spam filters have a "rating" system (The one provided to our company by Google worked this way). The rating would go up if it matched known-patterns The rating would go up if it matched known keywords (Many keywords related to drugs, ...


2

The email spam filters are not 100% effective, that's a fact and you said it correctly. As their name suggests they are filters, if something doesn't match the filter, it slips through, but that is why there are multiple levels of security used while receiving an email. Therefore if one fails, there are more checks being performed. This time it got caught by ...


10

A spam filter can be created that will block all spam; one could simply have the filter block all incoming email. Most users would find such a filter unacceptable, though, so the challenge is to find a balance between blocking email that users don't want to receive, but at the same time allowing through all the email they want to receive. If the filter is ...


7

The explanation I have always used is the analogy of "Why did my bullet proof vest not stop that bullet?" is because the bullet proof is a misnomer, and someone simply used a bullet designed to defeat your bullet resistant vest ;) Most people seem to get that concept that it is a balance of too tight (false positives restricting mail flow) and too loose ...


22

The main function of a SPAM filter is to block anything that looks like a SPAM. The objective of an anti-virus software is to detect and remove anything that possess the signature of a virus (worms included) based on the virus definition installed. Both programs work differently based on different heuristics. An email that doesn't look like a SPAM may ...


10

I like to use the analogy of an arms race as it's a familiar theme that non-technical people understand. Analogies are useful when trying to explain concepts such as this. Also throw in statistics. Last, use some pseudo-personal stuff to make them feel like you're in the same boat. Something like this may work: I completely understand your frustration with ...


3

You were right in your explanation. In trying to relay the issue, I would try to explain in less technical terms. Non-tech people don't like, and will have problems understanding technical explanations. So try to avoid them. Especially when they're already upset. I like to use cars. In this case, spam filters are like looking at a car. A look at the car ...


54

Your answer is pretty OK, but you could explain the ongoing "game" between spammers and spamfilters a bit more. This makes it understandable why some spam always will find its way to the customer. Spam filters try to catch all mail that is spam. Spammers try to create mails that are trusted not to be spam - both by spam filters and by humans. For ...


6

I think your answer is correct. Nothing is 100% bullet proof. That is why the user has to have some awareness and some knowledge to understand when and how things look strange and what to do next. (this last part is forgotten and people tend to trust too much in applications) That is why those situations occur, people discover that applications are not 100% ...


0

Logs is the most possible option. Since the server is in the DMZ, it would be rather easy. The AV will log the details of the triggered asset and the "ahost" machine thus proving that the proxy is doing what it is supposed to.


5

You can't really prove it, without going through proxy lo gs, antivirus logs etc., but you can certainly get confidence that it is by sending some test messages through with the EICAR signatures in it (see http://www.eicar.org/anti_virus_test_file.htm). You can then see whether it flags them.



Top 50 recent answers are included