I have a website that allows the user to upload files. The front-end (web tier) checks the file extension and first few bytes of the file for the magic number of an acceptable file, but then downstream a more thorough backend process scans the full contents of the file using a server-side virus scanner and file contents scrubber.

I have access only to the web front-end and I need to push a file through the upload functionality, such that:

  • The file extension is .doc, .docx, .pdf, .tiff, or .tif
  • The magic number of the file (the first ~4-6 bytes, depending on the file type) corresponds to the expected magic number for the extension (these first two bullets are required for the front-end to not immediately throw away the file when it's uploaded)
  • The contents of the file do not actually have the potential to cause any harm to someone if opened (that is to say, a good virus scanner SHOULD detect a virus, but the contents should actually be completely harmless, like the EICAR test string)
  • The file is short enough to conveniently be injected into the HexView of Fiddler during the HTTP POST request involving the file upload, because I can't download it into a file on my system and upload it because McAfee would detect it and I can't disable McAfee on my system
  • (Ideally) all the data in the file can be represented as printable UTF-8 characters

The virus scanner in use is from McAfee I believe, and should have a similar virus database, updated frequently.

I tried appending the EICAR string to a .tiff file, but this failed because the EICAR string is not supposed to be flagged as a virus if it is not starting from the beginning of a file (ignoring whitespace). Since the magic number of TIFF/PDF/DOC/DOCX is there at the front, the virus scanner does not think it is malicious.

How can I perform this test without triggering the virus scanner on my client and without downloading an actually harmful file?

  • Clarification needed: Why is your client a limiter here? I'd think you could momentarily disable your client's scanner, add the EICAR string inside a suitable file, run your test, and then re-enable your client's virus scanner. – sonnik Jan 22 '15 at 21:28
  • I don't have the capability to disable the virus scanner on my client because I don't have admin rights on the client. And anyway, since I have Fiddler, I can just inject the contents into the HTTP stream. What I need are the contents to be arranged in such a way that the magic number is there in the file, yet some fake virus payload is still contained in the file. EICAR doesn't work because virus scanners will not detect EICAR unless it's at the start of the file (this is an intended feature of virus scanners' EICAR detection, otherwise you'd get a virus popup for loading a webpage with it) – allquixotic Jan 22 '15 at 21:37
  • 3
    I'm afraid this might be a situation where you just have waaay too many constraints and requirements for a feasible solution to exist. You want it to be picked up by virus scanners, yet it has to be harmless. You want it to be the data to be printable, yet it must have the file signature of one of the allowed file formats. You want the backend AV to catch it, but it can't trigger your own computer's AV. I'm not aware of any antivirus test standard other than EICAR, so if EICAR doesn't work for you then you really don't have any options other than to work with real malware samples. – tlng05 Jan 23 '15 at 1:28

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.