Trend Micro Strikes the Letter P from the Alphabet

Trend Micro is alerting its solution providers and customers about a bug in an update to one of its security products that inadvertently blocked all incoming e-mail containing the letter P. The bug was in an antispam update, called Rule #915, to Trend Micro eManager, an e-mail content security product that provides content filtering, spam blocking and reporting.

Rule #915 contains a routine that quarantines all incoming e-mail containing the letter P. Trend Micro discovered the bug soon after releasing Rule #915 and issued Rule #916 to fix it an hour and a half later. Customers who installed the flawed Rule #915 should download and install Rule #916 immediately, the vendor said. Customers can learn how to recover e-mails that were inadvertently quarantined by the flawed update by calling Trend Micro or by going to the Knowledge Base on Trend Micro’s Web site and searching for Solution ID number 14638.

So this raises some interesting questions. “In the United States, customers have been contacted directly via e-mail, and we’ve notified the reseller channel.” I wonder if those emails had the letter P in them. And, their QA actually signed off a product that rejected p but accepted 25 other potentially dangerous alphabetical characters ? The mind boggles. The only way to be safe is to block all the evil characters and let the digits through. But wait, Digits are safe? I think not. Recent studies indicate that up to 100% of virus-infected e-mails contain digits, particularly “1″ and “0.” This gives us an easy, 100% effective solution to the virus problem: block all communications contining those two troublesome digits.

Kudos to Trend Micro for correcting the problem in under two hours. I assume the letter they sent to their customers read something like this.

Due to recent a recent bug, any emails containing the letter ‘P’ have been filtered by an update to our software.

You can recover your email from the ‘Quarantine’ folder.

We are sorry for any confusion this might have caused, and include the missing material below:

Please insert as required.

PPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPP

pppppppppppppppppppppppppppppppppppppppppppp [Comment on this Post]