[SRX] Sophos AV is not able to detect manually created ZIP files

Description

This article provides a working and non-working example of Sophos detecting a virus in a ZIP file.

Symptoms

When using Sophos AV , SRX is able to detect virus files in files including .zip files. However virus files may not be detected if a malicious file was recently compressed (zipped).

Example Test:

Topology:

Client ---  SRX ------- Internet ------Sophos
             |
             |
         Web Server (10.10.245.2)
         - eicar_html.html
         - eicar_html.zip   (manually hashed Eicar file)

When attempting to download the file, eicar.html, through the SRX, the virus is detected, as shown below:

wget http://10.10.245.2:80/eicar.html

root@srx# run show security flow session destination-prefix 10.10.245.2
Session ID: 12561, Policy name: OD/5, Timeout: 2, Valid
  In: 192.168.146.41/64313 --> 10.10.245.2/80;tcp, Conn Tag: 0x0, If: ge-0/0/0.0, Pkts: 4, Bytes: 319,
  Out: 10.10.245.2/80 --> 192.168.146.41/64313;tcp, Conn Tag: 0x0, If:ge-0/0/1.0, Pkts: 3, Bytes: 387,
Total sessions: 1

root@srx# run show log messages| last 100
Apr 24 13:54:55 srx clear-log[3295]: logfile cleared
Apr 24 13:55:02  srx RT_UTM: AV_VIRUS_DETECTED_MT: AntiVirus: Virusdetected: 10.10.245.2:80->192.168.146.41:64312 source-zone="untrust" profile-name="junos-sophos-av-defaults" file="10.10.245.2/eicar.html" temp_file="10.10.245.2/eicar.html" virus="EICAR-AV-Test" URL="HTTP://SXL2-01.P.LINK.SOPHOS.COM/T/en/EICAR-AV-Test" username="N/A" roles="N/A"
Apr 24 13:55:24  srx RT_UTM: AV_VIRUS_DETECTED_MT: AntiVirus: Virusdetected: 10.10.245.2:80->192.168.146.41:64313 source-zone="untrust" profile-name="junos-sophos-av-defaults" file="10.10.245.2/eicar.html" temp_file="10.10.245.2/eicar.html" virus="EICAR-AV-Test" URL="HTTP://SXL2-01.P.LINK.SOPHOS.COM/T/en/EICAR-AV-Test" username="N/A" roles="N/A"

However, when the malicious html file is compressed (zipped), the SRX is not able to detect the virus, as shown below:

wget http://10.10.245.2:80/eicar.zip

root@srx# run show security flow session destination-prefix 10.10.245.2
Session ID: 12063, Policy name: OD/5, Timeout: 1798, Valid
  In: 192.168.146.41/64305 --> 10.10.245.2/80;tcp, Conn Tag: 0x0, If: ge-0/0/0.0, Pkts: 3, Bytes: 278,
  Out: 10.10.245.2/80 --> 192.168.146.41/64305;tcp, Conn Tag: 0x0, If:ge-0/0/1.0, Pkts: 3, Bytes: 532,
Total sessions: 1

root@srx# run show log messages| last 100
Apr 24 13:51:31 srx clear-log[3280]: logfile cleared
Apr 24 13:51:59  srx RT_UTM: AV_FILE_NOT_SCANNED_PASSED_MT: AntiVirus: 10.10.245.2:80->192.168.146.41:64304 profile-name="junos-sophos-av-defaults" file="10.10.245.2/eicar.zip" action="PASSED" reason="due to AV scan timeout" scan-code="13" username="N/A" roles="N/A".
Apr 24 13:52:16  srx RT_UTM: AV_FILE_NOT_SCANNED_PASSED_MT: AntiVirus: 10.10.245.2:80->192.168.146.41:64305 profile-name="junos-sophos-av-defaults" file="10.10.245.2/eicar.zip" action="PASSED" reason="due to AV scan timeout" scan-code="13" username="N/A" roles="N/A".

Solution

This is by design.

Sophos AV does not decompress zipped files but instead uses a checksum of the compressed file for virus detection. If the compressed file checksum is in the Sophos Cloud database as a known virus file, the compressed file will be detected and blocked.

In the above test, the eicar.html checksum is in the Sophos database, so it is detected as expected. When the eicar.html file is compressed, the checksum of the compressed file is not in the Sophos database resulting in the file not being detected. If the EICAR ZIP file from the EICAR web download page is used, the checksum is in the Sophos database resulting in the SRX detecting and blocking as expected.