Guest User!

You are not Sophos Staff.

Thread Info
  • State Verified Answer
  • +2 person also asked this people also asked this
  • Locked Locked
  • Replies 4 replies
  • Subscribers 29 subscribers
  • Views 614 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Sandstorm/Zero-day scan page no longer displays

Derek Delfino2

Hello!

We have noticed since XG V18.5 that the Sandstorm/Zero-day file download scanning page no longer shows. In previous versions when a user downloads a file a Sophos web page appeared letting the user know that their file was being scanned and would let them know when it was ready to be downloaded.

What is happening now is the file shows (Failed - Network Error) on chrome and edge. This is resulting in the user clicking the download button several times and sandstorm scanning each instance over and over.

When reviewing the logs it shows that Sandstorm is scanning and the progress is pending, after several moments the scan completes and the user can then click download again.

Nothing has changed with our configurations or certificates and only appears to be happening with the newer version of Sophos XG. We recently upgraded from 18.5 to 19.0 and well and seem to have the same issues. Anyone else seeing this?



This thread was automatically locked due to age.
Parents
  • 0

    You are using the DPI Engine (TLS/SSL Inspection) not the proxy, correct? 

    This is actually a wanted behavior, as the DPI Engine cannot redirect on this level. 

    But if the user "click again on the same download" it should show the waiting page (if the website supports this behavior). The reason is, DPI will try to slow down the download for some time but most browser notice this behavior and throw a "network error". 

    __________________________________________________________________________________________________________________

  • 0 in reply to LuCar Toni

    Thanks for the reply LuCar!

    Yes we're using DPI Engine with certs on all endpoints. What's strange is we never actually saw this before until we upgraded. We always had a tab open in the browser with the Sophos sandstorm page letting our end user know that is was scanning and when it was ready.

    As you can see in the above screenshot, the end user tried to download that file 4 times and was never shown a scan page.

    So you're saying the website has to support this behavior?

Reply
  • 0 in reply to LuCar Toni

    Thanks for the reply LuCar!

    Yes we're using DPI Engine with certs on all endpoints. What's strange is we never actually saw this before until we upgraded. We always had a tab open in the browser with the Sophos sandstorm page letting our end user know that is was scanning and when it was ready.

    As you can see in the above screenshot, the end user tried to download that file 4 times and was never shown a scan page.

    So you're saying the website has to support this behavior?

Children
  • +1 in reply to Derek Delfino2

    Kind of has to support this, yes. I cannot tell you, why this worked before, maybe the website changed something. But basically the DPI Engine struggles to "redirect" a certain resource, if there is nothing to redirect. So if the website presents a new download link all the time, we cannot redirect this request. Does the notification page work for other downloads? 

    __________________________________________________________________________________________________________________

  • +1 in reply to LuCar Toni

    When you click on the link, the file if downloaded to the XG, and all but the last packet is sent to the client browser.  The last packet is held while the XG A/V scans the file.  If the file needs to be sandstorm'd then the connection is dropped.  DPI will then remember  (cache) the URL.  If anyone visits that exact same URL again in the next few minutes, they should get a Sandstorm pending page.

    That cache that allows it to display the pending page only works if the next download attempt is the exact same URL.  But if the URL changes every click (for example with a timestamp passed in as a query parameter) then the DPI engine cannot be assured it is trying to download the same file.

    Consider:
    download.com/download.php?file=myfile1.exe&timestamp=1111

    If the file has to be sandstorm'd the download fails.  The next download for the same URL will not actually start a download attempt, it will show a sandstorm page.

    If the url changes at all (as it does in these two examples) then we cannot assume it is the same file, so we have to download it again, virus scan it again, etc.

    download.com/download.php?file=myfile1.exe&timestamp=2222
    download.com/download.php?file=myotherfile2.exe&timestamp=1

    I don't recall, but potentially POST are never cached, because we cannot see the passed in parameters.

    Websites that always use the same link will show the sandstorm page on the second attempt.  Websites that change the link will not.  There is no change in the XG behavior in this in any recent release.

Unfiltered HTML