Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

This is based on Stack Exchange podcast # 25.

I really don't understand why there would need to be virus checking on uploaded files. It would generally be a bad idea to execute anything which was uploaded, so, so long as you make sure the files can't be executed... Granted, I also use Linux for my servers, so I leave the "execute" bit off.

share|improve this question

5 Answers 5

The main reason to check uploaded files for viruses, is that you can claim that you used state of the art technology and processes to protect your clients.

Assume another user gets infected by a file downloaded from your servers. He might try to sue you or report your to the trade authorities.

share|improve this answer

"so long as you make sure the files can't be executed"

Most formal theories of security are predicated on a logical expression of one or conditions. The problem with formal theories is they fail to anticipate behaviors outside the model. How do you make sure that the files cannot be executed?

Even Linux and Mac OS X/BSD machines occasionally come into contact with file systems that do not have execute permissions. Specifically, most removable flash media are formatted as FAT32.

Do your Linux machines automatically mount removable media?

Do you have WINE or another Windows compatibility framework installed?

If you answered yes to both these questions then congratulations: you too can be infected by Windows malware!

On the other hand if you virus-scan every file by default then you have less to worry about.

I disagree slightly with Hendrik. The main reason to check files for malware is to keep your own systems up and running efficiently. Then secondarily to keep your clients clean. If you lack the resources to operate, then fairly soon you won't have any. And virus scanning files is not really an onerous chore if you automate it.

share|improve this answer
    
Some of this is correct in a non-controlled desktop environment, but it is not really likely that your server will be running Wine. –  cwallenpoole Nov 3 '11 at 4:51
    
@cwallenpoole If it's available on the network, the server does not need to be the WINE host. Even in managed environments there are authorized devices running unauthorized software. Depending on the users WINE may even be authorized software. –  this.josh Nov 4 '11 at 1:40

The problem is that your core assumption there is, or may be, flawed in many circumstances. You say that:

It would generally be a bad idea to execute anything which was uploaded

  • Well, for a lot of functions this isn't true. Some functionality requires execution of uploads
  • Are you 100% sure you have secured every possible vulnerability?
  • Are uploads going to be downloaded by others, who don't have as secure an enevironment as you?

Virus/malware checking on upload is to add a layer of protection because circumstances change, mistakes happen, vulnerabilities are discovered.

share|improve this answer

The server may not be executing anything - if it helps, think of it as a smarter disk. One user saves an infected file to the disk/to your server, another user copies the file off it. The server has never executed the file, yet it served as a vector for spreading the infection.

Therefore, it makes some sense to check the files as they are stored, even if the server itself is not necessarily vulnerable to the infections.

share|improve this answer

Without having listened to the podcast itself, I guess it depends what you are doing with the uploaded files. Just taking off the execute bit won't help, e.g. if someone uploads a php file into your document root then calls it's URL.

AV checking is very limited in detecting malware.

The best solution is to convert the files to a different format and be careful about file extensions - as discussed here recently.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.