0

Imagine I am on [email protected] and I send a mail to [email protected] with an eicar.txt as an attachement. Will the email be stopped because it contains the eicar.txt ?

In case there is an email scanning mechanism, how can I know which antivirus is used by the email provider to scan the mails ?

For instance does outlook use Microsoft defender to scan the content of a mail ? How can I know what antivirus is used by gmail for example ? Is this information public or should we dig deeper with osint and other tools ?

8
  • Welcome to the community. I think most of the technologies used are apparently proprietary and custom built, but nothing is preventing you from spinning up your own instance of an email server with ClamAV or similar software. Commented Nov 16, 2022 at 17:37
  • Thank you for your answer ! Are you sure the technologies are custom built ? Normally making you own AV with signature detection is quite expensive. Isn't it much cheaper for mail providing companies to have a contract with kaspersky for example to scan their mail ? @SirMuffington
    – Rudeus
    Commented Nov 16, 2022 at 17:41
  • And even if the information about the AV is secret, isn't there ways for a malicious attacker to identify the AV used by OSINT or other types of investigations and experimentation ? @SirMuffington
    – Rudeus
    Commented Nov 16, 2022 at 17:43
  • I don't know what decision making process was made by the management of the big companies... But there must've been a good reason to spin up their own solution... You could in theory identify something from quite a big number of samples, but that wouldn't quite show how it works inside... What's your goal with your question btw? This seems to go beyond the blue team goal... Commented Nov 16, 2022 at 17:45
  • My goal is to see to what extend attacker can gain information about the AV of a mail provider by interacting in a Blackbox context. Don't worry it is purely academics. People warned me I should give up because there is little information and documentation about this specific subject ...@SirMuffington
    – Rudeus
    Commented Nov 16, 2022 at 17:49

1 Answer 1

1

Does email provider scan mails for viruses?

This entirely depends on the mail provider. But the bigger ones include spam, phishing and also malware protection. Which technology they use and maybe even the specific products are usually not public information.

6
  • So basically there is no way to know what antivirus they are using ? Even by sending malware samples to check if they are being detected ?
    – Rudeus
    Commented Nov 16, 2022 at 17:33
  • or maybe sending a bugged file that notifies us when it is scanned ?
    – Rudeus
    Commented Nov 16, 2022 at 17:37
  • How do you expect for a file to send out packets or anything that would alert from being analyzed? That's like a beacon in Ghidra - I doubt that's currently technically possible... Commented Nov 16, 2022 at 17:48
  • @Rudeus: It is not even clear if they use any of the established products, or a combination of many products and even combined with their own technology. You might make some assumptions by probing with specific files which you can compare how known antivirus engines detect these. Commented Nov 16, 2022 at 18:43
  • @SteffenUllrich a part from using virtustotal and comparing detection, I thought of zipping eicar with gradually strong password. I heard that some antivirus engine attempts to crack the zip file then scan the content. Do you have other method or ideas ? Public database of signature for antivirus maybe ?
    – Rudeus
    Commented Nov 16, 2022 at 19:45

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .