Let's say I have one server called A which host an upload website which is connected at the network connection B. Let's say one of my clients uploads multiple .rar files of 1 MB (that contains malware parts) and when I unzip them I rebuild the malware. Is there a way to detect that malware parts before I unzip the files?
Can I have a firewall/device that will check all the files between A and B and block them?
Is this technically possible?
Usually analysis works only at the level of a single download and it is really hard to do it differently. The firewall has no knowledge that a specific download is only one part of a larger download session and where the rest of the data can be downloaded for a complete analysis.
But depending on the file format the firewall might at least detect that it is a part of a larger download or that this is some unknown data format. And it might have a white list which types of data are allowed and unknown data or partial archives are not part of this white list. In this case the firewall might not be able to analyse the download for malware but it might decide to block the download because the contents is not on the white list.
This kind of situation also happens with download accelerators or resuming of downloads in which case the firewall would also only see a partial download. Some firewalls deal with this case by changing the request of the client so that it results in a full download which then can be analyzed by the firewall.
In general, this is an unsolvable problem. Consider the situation where a user uploads encrypted zip files: you can only unzip them if you have the password for each one. Without that password, you can see the name of the contents, but nothing else.
Each of these files may be perfectly legitimate: maybe they are Word documents. Your firewall can see that they are Word documents, just not what the contents are. You might even be able to guess the passwords for a few of these zip files, and unzip the Word documents, to find that they are indeed valid Word documents. However, Word documents are, in modern versions, zip files themselves, which can essentially contain anything. Your firewall wouldn't have a chance of finding that without knowing the password for the outer zip file, and then inspecting the contents of the inner file too.
This isn't the only combination that will allow arbitrary files past most firewalls. Consider sending a Word document which contains a string of Base64 text, which, upon decoding, is a malicious binary. Whatever tricks you think up to prevent files being introduced to your environment, it's possible to think of ways to bypass them.
One better way to deal with this problem is to allow data in, but enforce the use of on-access malware detection. This triggers as soon as a file is decrypted, or reconstructed, and deletes it, or blocks access to it. It also has the advantage of working against malware introduced by means that bypass firewalls - USB sticks, mobile devices plugged in to charge, files transferred to laptops whilst on other networks.
