Let's say I have one server called A which host an upload website which is connected at the network connection B. Let's say one of my clients uploads multiple .rar files of 1 MB (that contains malware parts) and when I unzip them I rebuild the malware. Is there a way to detect that malware parts before I unzip the files?

Can I have a firewall/device that will check all the files between A and B and block them?

Is this technically possible?


Usually analysis works only at the level of a single download and it is really hard to do it differently. The firewall has no knowledge that a specific download is only one part of a larger download session and where the rest of the data can be downloaded for a complete analysis.

But depending on the file format the firewall might at least detect that it is a part of a larger download or that this is some unknown data format. And it might have a white list which types of data are allowed and unknown data or partial archives are not part of this white list. In this case the firewall might not be able to analyse the download for malware but it might decide to block the download because the contents is not on the white list.

This kind of situation also happens with download accelerators or resuming of downloads in which case the firewall would also only see a partial download. Some firewalls deal with this case by changing the request of the client so that it results in a full download which then can be analyzed by the firewall.

  • Ok but ... can you prevent a malware to rebuild itself from multiple files by "scrambling" the file bits? I am thinking at simple math right now... Let's say I have two simple math based on the following format A + B + C = D and to rebuild the malware I need the A component of every D file ... but what if I do: A-(+2) + B - (-2) + C = D in this case A part is different. Can this principle be applied to files and bits? (even if you use this for simple files like .jpg / .pdf) Mar 21 '16 at 15:13
  • Or can you put all the files in a Sandbox to see the output of files uploaded by a user? Mar 21 '16 at 15:14
  • @dvvcnxc: like I said - the firewall has no information which files belong together. There are 1000s of files transferred through the firewall during some time and 10 of these has some kind of relation which is not up-front known by the firewall. And even if the firewall would deal with this very specific case where a gullible user downloads all parts and puts these together: the next time the attacker would just use an encrypted ZIP and put the password in a text file so that the firewall cannot extract the data but the user can. Mar 21 '16 at 15:17
  • And what if I can unzip every file set from a specific user in an sandbox to check later for malware activity? Is there a tool to do that? And what if I deny by default encrypted files or files that response to encryption like pattern ? Mar 21 '16 at 15:28
  • @dvvcnxc: about denying by file type: see what I wrote about it. And of course you might try to preserve all files downloaded by a user forever and put them all together in a sandbox whenever a new file gets downloaded. But apart from being a perfomance nightmare you have to still reproduce what the user might do with these files - without having the information what the user intends too do. Mar 21 '16 at 15:46

In general, this is an unsolvable problem. Consider the situation where a user uploads encrypted zip files: you can only unzip them if you have the password for each one. Without that password, you can see the name of the contents, but nothing else.

Each of these files may be perfectly legitimate: maybe they are Word documents. Your firewall can see that they are Word documents, just not what the contents are. You might even be able to guess the passwords for a few of these zip files, and unzip the Word documents, to find that they are indeed valid Word documents. However, Word documents are, in modern versions, zip files themselves, which can essentially contain anything. Your firewall wouldn't have a chance of finding that without knowing the password for the outer zip file, and then inspecting the contents of the inner file too.

This isn't the only combination that will allow arbitrary files past most firewalls. Consider sending a Word document which contains a string of Base64 text, which, upon decoding, is a malicious binary. Whatever tricks you think up to prevent files being introduced to your environment, it's possible to think of ways to bypass them.

One better way to deal with this problem is to allow data in, but enforce the use of on-access malware detection. This triggers as soon as a file is decrypted, or reconstructed, and deletes it, or blocks access to it. It also has the advantage of working against malware introduced by means that bypass firewalls - USB sticks, mobile devices plugged in to charge, files transferred to laptops whilst on other networks.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.