Update on Sophos and Google Analytics

Filed Under: Uncategorized

It's never fun to admit when you've made a mistake, but we made one earlier today. What's worse is that it affected some of our customers.

At 05:15 GMT, Sophos's automatic systems mistakenly blocked web content at google-analytics.com, misidentifying it as Mal/HTMLGen-A.

As a result, Sophos Live Protection would report Mal/HTMLGen-A when visiting webpages which reference google-analytics.com. Similarly, the Sophos web appliance would block the download of Google Analytics content. Consequently, Sophos customers could receive incorrect reports about google-analytics.com.

If you're an affected Sophos customer you may have seen an alert like this:

Sophos false positive

High risk website blocked

Access has been blocked to "www.google-analytics.com/ga.js" as 'Mal/HTMLGen-A' has been found at this website.

At 06:08 GMT (53 minutes later) the problem had been identified by Sophos staff, and steps were taken to rectify the problem and ensure that it could not happen again in the future. This fix is currently propagating through our systems - no change is required on customers' computers.

However, it may be that some customers are still experiencing the erroneous warning messages about google-analytics.com. This is something which we hope will be resolved shortly.

We would like to apologise for any inconvenience caused by this false positive, and reassure customers that an investigation is taking place and steps have already been taken to prevent it from happening again. Even though no other web content was blocked, and it should not have impacted normal browsing by users, we recognise that the warning message can be disruptive.

Fortunately, no action is required by customers to benefit from the fix.

Update: We believe that all Sophos customers have now had this issue resolved. If you are still experiencing problems, please contact our technical support department.

For more information, please visit Sophos's support knowledgebase article.

, , , , ,

You might like

8 Responses to Update on Sophos and Google Analytics

  1. Sam · 1140 days ago

    Wouldn't be surprised if Sophos is mysteriously not listed in any Google search pages tomorrow

    • :-) Well, funnily enough try searching for "Naked Security" with Google's Safe Search filter set to "Strict"... Maybe we deserve that.

      Same kind of thing happens if you hunt for Jamie Oliver's moniker, the Naked Chef..

      Again, apologies to everyone affected by our false positive - including our friends at Google.

  2. MOH · 1140 days ago

    thanks for fix

  3. Project Manager · 1140 days ago

    Yea we've got a load of grief from our clients using your software thinking that their site had been hacked. Thanks for the speedy response though

    • Sorry about the trouble caused. I hope things are okay now. You can always point your clients to this webpage if it helps

  4. Gary H. · 1140 days ago

    Nice to see you practice what you preach, where transparency and honesty is concerned.

  5. easyosx · 1140 days ago

    Well this happens to all AV's at some point or another, but this probably isn't the worst case ever (McAfee's problem last year anyone?).

  6. ProfRalph · 848 days ago

    It's still blocking Project Free TV, which really ticks me off. It won't allow me to go to the page.

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s

About the author

Graham Cluley runs his own award-winning computer security blog, and is a veteran of the anti-virus industry having worked for a number of security companies since the early 1990s. Now an independent security analyst, he regularly makes media appearances and gives computer security presentations. Send Graham an email, subscribe to his updates on Facebook, follow him on Twitter and App.net, and circle him on Google Plus for regular updates.