Invoke an antimalware scanner from code on azure Roles

Question

We have a requirement to scan uploaded images via azure services.

I found that Azure has a free out of the box solution http://azure.microsoft.com/en-us/support/legal/endpoint-protection/

However simply enabling anti malware is not enough for our scenario.

There are more than one WebRole that can upload images. and also some files may end up in the system via different channels

ex.

• An business entity has a property ImageUrl. Url points somewhere in the internet, blob storage or any other cdn.
• If the object has some updated info, it's entered in a queue for further processing
• There is a job that process the image URL, downloads it and does some work. then finally it will be used by any company system.

We thought that because all images will go through "Image processing job" before downloading and processing we should check for viruses. if the virus is found then fail the job with corresponding error and move to the next image.

I could not find how to invoke azure anti malware from source code anyway of getting realtime feedback from the virus scanner.

Answer 1

You are going to be fighting somewhat of an uphill battle to implement this the way you want to. For whatever reason, local anti-virus systems typically do not give an API for such interactions. I will give a few options:

1) Scan your files on a storage server after they have been uploaded. Then, check back later to see if the AV has zapped them.

pros: Easy to implement. cons: Malware may make it deeper into your back end.

2)Use an open source AV solution such as clamAV, and look for a language binding that will do what you need it to do. pros: Allows you to check on the results of the scans when you want to in the process. cons: Open source. Potentially buggy.

3)Pay a large AV vendor to modify their solution to your needs. pros: Will do whatever you pay the AV guys to make it do. cons: Very expensive.

4)hash the file, and query a public AV provider like virus total. pros: Cheap and easy. cons: May fail to find custom malware, or malware that is new. Slight loss on the privacy front.

5)Upload the file to a public AV prover like virus total pros: Cheap, easy, and effective. More likely to find custom malware via heuristics. cons: Much bigger privacy loss for your customers.

6)Pay for an external service to hash/scan your files that you communicate with via API, and promises secrecy. pros: works pretty well. cons: Expensive. Promises of secrecy doesn't obviate privacy issues.