2

We have a .NET MVC website with a WCF Service as a service layer. One of the feature that the service offers is the ability to upload documents. When we asked our security consultant to test our system for vulnerabilities, he found that a user can upload EICAR.txt (an innocuous string that acts as an virus to all antivirus software) can be uploaded to the system.

This file basically goes as a Byte Stream from upload function and gets saved to the database as a BLOB through a service call. The servers (both IIS web server and database server) are loaded with antivirus.

You can not go to these servers and download an EICAR file beucase antivirus just wouldn't let you do that. However, when the file reaches the IIS server as a Byte[] or when it reaches the database server as a BLOB through the application code, it goes through.

Is there any way to make my application robust so that it is safe against virus infected files?

2

Let's not overestimate the finding of the security consultant because some of them don't really know what they do. Of course I don't know the real report and can base my opinion only on what you wrote. But I had once to do with a report where the consultant complained that the EICAR virus was not found by a firewall when it was used as a subject of a mail, even though the intended use for the EICAR test virus says explicitly:

Any anti-virus product that supports the EICAR test file should detect it in any file providing that the file starts with the following 68 characters, and is exactly 68 bytes long...

Thus, detecting the code inside some byte stream inside an application or database does not cover the usage at all because it is not a file. And maybe it does not even fit the other requirements about start and length. But it would be bad if the byte stream gets actually saved somewhere as a file, like when downloaded by the browser.

There is a reason for this usage restriction of the test virus: The byte stream of a virus is not dangerous by itself. It is only a problem when it is used in a context where it can be executed, typically when it is saved as a file with a specific extension like .exe, .com, .scr, .dll etc.

But is is true that if the malicious code is already loaded inside an application it might also be executed by other means, either deliberately or due to a bug like a buffer overflow. Deliberate execution would also be possible if the code was hidden with for example encryption so it does not matter. And buffer overflow would not execute the malicious code directly but there would be some code first which exploits the buffer overflow to then execute the specific code. And even this exploit code might include some simple XOR to decode the real malicious code first.

This means that looking for the signature of malware somewhere inside some byte stream which may or may not ever be used directly in execution might cause more false alarms than be of real use. Therefore make sure that you don't execute any code yourself you have in the database and that you don't send anybody the data inside a download or save them as a single file yourself.

Apart from that enterprise antivirus products often have an API (or offer ICAP) so you can send any byte stream you want to the antivirus for analysis. This should be done inside your application on any place you consider it necessary. And of course you should be aware that this was just a test virus and that antivirus will not find all possible malware, so you never can offer a full protection.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.