search

NethServer / dev

NethServer issue tracker
https://github.com/NethServer/dev/issues
63 stars 20 forks source link

Scan MS Office files for bad macros #5891

Closed filippocarletti closed 4 years ago

filippocarletti commented 4 years ago

Using oletools (http://www.decalage.info/python/oletools) we could scan MS Office files looking for suspicious macros and block malicious emails.

We need:

  1. oletools with olefy
  2. rspamd config (see https://rspamd.com/doc/modules/external_services.html#oletools-specific-details)
  3. rspamd score to refuse emails
  4. a configuration db option (enabled by default)
  5. (optional) web UI options
DavidePrincipi commented 4 years ago
nethbot commented 4 years ago

in 7.7.1908/testing:

nethbot commented 4 years ago

in 7.7.1908/testing:

stephdl commented 4 years ago

QA

filippocarletti commented 4 years ago

Sender SMTP refusal message: 554 5.7.1 Rejected suspicious office document macro

Destination system maillog:

Oct 30 11:32:20 mail rspamd[14718]: <c01275>; lua; common.lua:102: oletools: result - office macrofound: "AutoExec + Suspicious (autoopen,Open,system,ShowWindow,CreateObject) - score: 1"
Oct 30 11:32:20 mail rspamd[14718]: <c01275>; proxy; rspamd_add_passthrough_result: <20191002151742.309027F05E@mhssub101.bizmail.nifty.com>: set pre-result to 'reject' (no score): 'Rejected suspicious office document macro' from oletools(1)

rspamd symbol: OLETOOLS

nethbot commented 4 years ago

in 7.7.1908/testing:

nethbot commented 4 years ago

in 7.7.1908/testing:

nethbot commented 4 years ago

in 7.7.1908/testing:

nethbot commented 4 years ago

in 7.7.1908/testing:

nethbot commented 4 years ago

in 7.7.1908/testing:

nethbot commented 4 years ago

in 7.7.1908/updates:

nethbot commented 4 years ago

in 7.7.1908/updates: