It’s never fun to admit when you’ve made a mistake, but we made one earlier today. What’s worse is that it affected some of our customers.
At 05:15 GMT, Sophos’s automatic systems mistakenly blocked web content at google-analytics.com, misidentifying it as Mal/HTMLGen-A.
As a result, Sophos Live Protection would report Mal/HTMLGen-A when visiting webpages which reference google-analytics.com. Similarly, the Sophos web appliance would block the download of Google Analytics content. Consequently, Sophos customers could receive incorrect reports about google-analytics.com.
If you’re an affected Sophos customer you may have seen an alert like this:
High risk website blocked
Access has been blocked to "www.google-analytics.com/ga.js" as 'Mal/HTMLGen-A' has been found at this website.
At 06:08 GMT (53 minutes later) the problem had been identified by Sophos staff, and steps were taken to rectify the problem and ensure that it could not happen again in the future. This fix is currently propagating through our systems – no change is required on customers’ computers.
However, it may be that some customers are still experiencing the erroneous warning messages about google-analytics.com. This is something which we hope will be resolved shortly.
We would like to apologise for any inconvenience caused by this false positive, and reassure customers that an investigation is taking place and steps have already been taken to prevent it from happening again. Even though no other web content was blocked, and it should not have impacted normal browsing by users, we recognise that the warning message can be disruptive.
Fortunately, no action is required by customers to benefit from the fix.
Update: We believe that all Sophos customers have now had this issue resolved. If you are still experiencing problems, please contact our technical support department.
For more information, please visit Sophos’s support knowledgebase article.
