Why can I Download EICAR wenn DPI is on

Hi Dirk,

please post a copy of your firewall rule and the SSL/TLS rule which are causing the issue.

Ian

Same here for me with the mirror abvoe.

On this mirror my XG is blocking EICAR:

If you use DPI Engine, is the website decrypted? Do you see the Certificate replaced of this website? 

Check if http://sophostest.com and https://sophostest.com work as expected. 

Hi Dom,

I was able to download all but one of the files, the Sophos Home premium stopped all of them on my MBP.

You have raised an interesting question.

Basically from the test DPI appears to check the connection, but not the content, that would appear to be a big weakness in the DPI setup/build?

So you need the proxy for content scanning and DPI only does the connection security.

When I performed the test I disabled the web proxy two boxes and left the other web security as was.

Lets us hope that support whizkid reviews this thread and can enlighten us on our configuration or expectation failings.

Ian

Hi folks,

further thoughts on this issue. You would need to setup an SSL/TLS rule that enables decrypt and not use the default rule. I suspect that is where my tests have gone wrong because I am using the default rule which is do not decrypt.

Ian

Hi folks,

further thoughts on this issue. You would need to setup an SSL/TLS rule that enables decrypt and not use the default rule. I suspect that is where my tests have gone wrong because I am using the default rule which is do not decrypt.

Ian

I checked it in the logs:

The download is hosted on meineipadresse.de and my profile does encryption on it.

However it is TLS1.3. Maybe this is a bug or fallback behrvior  in XG?

(I have encryption for 1.3 active as well)

I tested this a couple of different ways, using both the web proxy and DPI - neither blocked the download from eicar.org (both the HTTP and HTTPS links) with decrypt and scan disabled (that is in the SSL "decrypt all" rule itself).

Sophos Home picked it up regardless, as did the XG when HTTPS inspection was enabled. That struck me as being a bit weird, though I've not looked closely at anything.

The check content for malware was turned on in all instances, I don't have a v17 to check this behaviour against.

Regards