3

I'm working on an application that makes use of the Symantec Protection Engine to scan uploaded files. I'm having issues with my files after they have been scanned. One possible solution I've seen is to store the uploaded file in a temporary folder, then stream it to the protection engine. If the engine determines the file is clean, I would then access the file from the temporary folder and pass it on to it's final home. If the file is dirty, delete the temporary folder and let the user know what the problem is.

So the question is, would storing the possibly infected files in a temporary folder open the system up to infections?

1

Well an infected file is harmless when stored on hard drive. It is only dangerous when it is opened or executed. So the real question is do you control everything that gets executed on the server? If so, IMHO, the best you can do to mitigate the risk is :

  1. allow only file types you really need (of course avoid executable files);
  2. save uploaded files with random names so it is harder to find for remote execution;
  3. make sure the temporary folder is not accessible from the Web and restrict access to it as much as possible (your app and Symantec Protection Engine);
  4. make sure you scan ALL uploaded files as soon as possible;
  5. if the scan result is anything but "no-virus found" delete the file.

You can test your system with the EICAR test file.

2

There's nothing inherently dangerous about a virus stored on a hard drive. To infect something viruses have to be executed in some manner. That means either directly being executed by the user, or exploiting some vulnerability in an application that opens the file.

Deleting the file if the engine says it's infected is also problematic. No anti-virus engine is perfectly accurate, and false positives happen all the time. This is why the general practice is to put infected files into a quarantine so they can be inspected manually later. That may or may not be appropriate for you based on your use case, but you do need to keep in mind that false positives happen all the time, and are normally more likely than viruses.

  • I agree with you : anti-virus engines aren't perfect but, unfortunately, you have no choice but to trust them. That's why you should delete files if anything goes wrong. False positives are sad but if you want to avoid that the only solution I see is to submit uploaded files to more than one anti-virus engine. You will be left to decide which anti-virus engine is right when you get contradictory results. – ForguesR Jan 22 '15 at 20:43
  • As they say in the car industry Your mileage may vary. Whether you delete them really depends on the value of the data, and the people you have to go and manually detect if the threat is real or not. Deleting a file that need to be delivered in a timely manner could be a disaster. Remember that security always need to be balanced with other concerns, and it's not possible to know what those other concerns are for other people and organizations since they vary greatly. – Steve Sether Jan 22 '15 at 20:48

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.