GFI email exploit engine. (Virus Notes).

GFI MailSecurity for Exchange/SMTP, GFI's new email security package, includes a revolutionary email exploit engine which detects exploits embedded in emails and shields users against any current or future email viruses and attacks that use known exploits.

Comment:

Why email exploits are dangerous

An exploit uses known vulnerabilities in applications or operating systems to execute a program or code; it "exploits" a feature of a program or the operating system for its own use, such as to execute arbitrary machine code, read/write files on the hard disk, or gain illicit access. An email exploit is an exploit embedded in an email that can be executed on the recipient's machine once the user opens or receives the email. This allows a hacker to bypass most firewalls and anti-virus products.

Protection against unknown email viruses and malicious code

Anti-virus software is designed to detect known malicious code. An email exploit engine takes a different approach: it works like an intrusion detection system (IDS) for email and analyses code for exploits that could be malicious. This means it can protect against new viruses, but most importantly against unknown viruses/malicious code. This is crucial as an unknown virus could be a one- off piece of code, developed specifically to break into an organization's network, and therefore might not be recognized by anti-virus engines.

Blocking Nimda, BadTrans.B, Klez.H in one go & their variants

The Nimda, BadTrans.B and Klez. H viruses all use the same exploit to propagate. Yet, when the BadTrans.B virus emerged, those who had anti-virus protection against Nimda were defenceless against it and needed a new virus definition file update to block it. Again, when Klez. H appeared, anti-virus vendors had to issue another new update to protect against that. Yet, the time taken to release a signature against each new threat is long enough for a network to be infected.

GFI's email exploit detection engine recognizes the exploit used and can block all three worms--and any variants--immediately and automatically, without the, need for definition file updates. GFI Security Labs conduct research in the hacker community to identify new exploits and incorporate them in the GFI MailSecurity exploit engine. www.gfi.com