Any ideas about how to check Azure's blob storage for viruses?

Question

Our application stores files uploaded from our customers to blob storage. These files are exchanged between different parties (our customers and their suppliers). Is there a way to check the uploaded files for viruses? The Antimalware service seems to just check virtual machines, but I cannot get any information about using it to check files as a service.

A great solution would be if we could store such a file in Azure Storage as an "on hold" file till it is checked. Then we would need a service to check this file and returns the result. If the file is virus-free we could then move it to the final destination.

Talkfest

Answer 1

Azure Storage is just... storage. There are no utilities built in, such as antivirus. You'd need to do your antivirus check on your own. Since antivirus tools typically only work with local OS storage, you'd need to place your "on hold" content (as you referred to it) on a local disk somewhere that you have antivirus installed and then copy to blob storage once your antivirus check is done.

How you accomplish managing this, and which software you use, is up to you. But VMs, App Services, and Cloud Services (web/worker roles) all have local disks available.

Spillar

Thank you David! It's a pity. Maybe this could be something for a niche product: virus check as a service. Just point the service to the stream/file and get a result. I understand your approach, but how would you know if the file was infected or not? – Talkfest

Answer 2

As the other answer states Azure Storage is just storage. There are a couple of ways you could do this though,

The first solution would be to run your own anti-virus and use this either as a gateway or programatically download the file from the Blob storage, check the file and then take the appropriate action. It's possible to run something like ClamAV to do this yourself.

Alternatively you could use a third party service like AttachmentScanner (which is exactly what you mention in your comment) which will accept a URL or a direct file upload. With Azure you can generate a temporary url pointing to the file with an expiration of a few minutes, pass the URL to AttachmentScanner and then take the appropriate action depending on the result.

Acetify

Just went to look at AttachmentScanner, looks interesting. Though I was really surprised that when I went to their signup/login pages that it doesn't force SSL. I tend to avoid companies that don't bother to enforce SSL to protect my information. – Gaultiero

2½ years later I notice the service is still in beta. Is this thing still a going concern? – Grunenwald

I'd be careful using 3rd party solutions that require you to upload files/provide a URL; if you do this, you'll be charged for egress data for every file you scan that lives in Azure storage. – Autocratic

Answer 3

You can use Azure Defender for Storage to detect following:

• Suspicious access patterns - such as successful access from a Tor exit node or from an IP considered suspicious by Microsoft Threat Intelligence
• Suspicious activities - such as anomalous data extraction or unusual change of access permissions
• Upload of malicious content - such as potential malware files (based on hash reputation analysis) or hosting of phishing content

And to enable it you need to go to Advanced security:

Amara

Answer 4

I read an article about virus scanning for blob storage. Might be useful for you. This guy is using an azure function trigger for the blob to catch the changes and sending the blob file to a virus scanner. The virus scanner is running in a docker container. Full implementation details are available in the link below

https://peterrombouts.nl/2019/04/15/scanning-blob-storage-for-viruses-with-azure-functions-and-docker/

Nagoya

Answer 5

I setup an "azinbox" folder on an azure file storage container. I setup a console application (job) on a VM to check every 30 seconds for a file in that folder. If the job finds it, it moves the file from azinbox to a vminbox folder on the VM. As soon as the files shows up on the VM, if it has a virus, it gets quarantined and the file is deleted from the vminbox. The job on the vm then checks 30 seconds later to see if the file is still in the vminbox. If it is, it must be OK. The job moves the validated file to an azoutbox folder on the azure file storage container. From the Web Site perspective, 1) upload the file to azinbox 2) wait a minute and check the azoutbox. If the file is found, the website moves the file from the azoutbox to its final destination.

I admit it is a crappy solution because it takes a LONG time to complete a file upload. A minute or two can seem like a long time to upload a simple PDF to the user especially if they have more than one to upload.

Also, this requires you setup an entire VM server JUST to validate a file for a virus.

If anyone has a better option, please let me know.

Caliber