Malware Scanner in Integration Suite

[helmut_skolaut3]

I have activated Malware scanning in Integration Suite:

Then I have uploaded a Ransomware JAR into a script Collection:

The source of the Ransomware is from here:
PanagiotisDrakatos/JavaRansomware: Simple Ransomware Tool in Pure Java (github.com)

I am wondering, i am getting no alerts - i could have uploaded it.

Looking into Note 3313373 or Help Page it should detect malicious Script Collection Artifacts. Is anybody knowing why it's not detecting my try-attack?

I have also tried to upload a malicious Pyton Script into an API Proxy Policy - also not detected - maybe this is not yet implemented. 

Thanks for your comments.

BR Helmut

[kamlesh_zanje]

Hello,

Thanks for sharing your query. Basically, Cloud integration of the integration suite subsumes the malware service from the BTP. 

However, malware service from the BTP underneath uses the CLAMAV (open-source anti-virus engine).

if the malicious content is not detected on the upload in the cloud integration capability of the integration suite, it means CLAMAV is not capable to detect that specific virus. To check this, you can upload the same malicious content in this https://www.virustotal.com/gui/. It has many anti-virus hosted. One of them is CLAMAV. Here as well, content will not be detected as malicious. 

[helmut_skolaut3]

Thanks for your reply. We have contacted SAP Consultant and he was reverting back the same just 2 days ago. But we have observed, that the virus has been detected using the URL you have shared, but Integration Suite doesn't detected it - my SAP Consultant has created an incident internally already to get this fixed.

BR Helmut

[kamlesh_zanje]

I think the SAP Consultant is Bousselmi, Samir. Right? I would suggest getting in touch with him for latest update.

[helmut_skolaut3]

Yes exactly 🙂