Why Your Firewall Blocks EICAR but Misses It Wrapped With Advanced Evasions

The Same File, Two Different Outcomes

A firewall that blocks a threat when it arrives plainly, and delivers the identical bytes when they arrive wrapped, has not detected anything. It has detected a format.

That difference is the whole measurement. The threat is constant, your signature coverage is constant, your licensing is constant. The only thing that changes between the two runs is how the content is presented on the wire. So whatever changes in the outcome is attributable to one thing and one thing only: whether your inspection held.

Most security testing cannot make that claim. Send real malware and a miss has two possible causes you cannot separate — the product lacked the signature, or the product never inspected the content at all. Those have completely different fixes. Controlling the payload removes the first explanation and leaves only the second.

The gap between the two results is your security efficacy: not a datasheet figure, but what your own stack does on your own network, under your own policy, today.

Why the Payload Is Deliberately Harmless

Every engineer who sees an EICAR-based test reacts the same way: that is not a real threat, any product blocks it. Correct on both counts. EICAR is a short, published test string containing no malicious code, and detection of it is effectively universal.

That universality is not a weakness in the test — it is the only reason the test can prove anything. A payload nobody could claim they would have missed anyway is the one payload that turns a miss into an unambiguous statement about inspection rather than an argument about signature coverage.

It follows that the plain run is not optional. If the unwrapped file is not blocked, stop: every later result is meaningless, and the real finding is that no content inspection is happening on that domain at all.

Why So Many Products Miss This

Not because the firewall fails to recognise the threat. Because the firewall and the computer receiving the file do not end up looking at the same thing.

1. The firewall has to predict how your computer will read the data

Content does not arrive as a finished file. It arrives as a stream that has to be put back together, and an inspection device must rebuild it exactlyas the receiving machine will. Standards leave room for interpretation, and implementations differ. Evasions exist to widen that gap deliberately — so the firewall assembles one thing, your computer assembles another, and the harmful version only ever exists at the destination.

2. Recognisable content can be made unrecognisable in transit

A signature matches a pattern. If the content is re-expressed or broken up as it crosses the wire, that pattern may never appear in any piece the firewall examines — even though the file reassembled on your machine is byte-for-byte identical to the one it would have blocked. Nothing was bypassed in the sense of being “beaten”; the thing being matched simply was not there to match.

3. The same content can be expressed many legitimate ways

Web standards permit a great deal of flexibility in how data is represented, and every product supports a subset of that flexibility. Anything outside the subset is not interpreted, so there is nothing for inspection to act on. Products are also typically assessed against one evasion at a time, while nothing stops them being combined — and combinations behave differently from their parts.

What This Does Not Tell You

Being clear about the limits matters as much as the claims:

• It measures inspection robustness, not signature quality or heuristic detection. A perfect score says nothing about whether you would catch a novel threat.
• It tests content being downloaded to a client. Inspection of outbound requests is a separate question.
• A delivered payload only means something if the plain run was blocked. Without that, you have measured nothing.

A tool that overstates what it proves is worse than no tool, because it produces confident people who are wrong.

Where to Run It

The AET Bypass Lab sends the same test file plainly and then wrapped with a range of advanced evasions, from single techniques through to combined ones, directly from your browser.

Two things will mislead you if you only watch the browser. Some firewalls keep a connection alive after a block but switch it to lighter inspection, and some briefly blocklist the source address — both make the next result look like a bypass when it is nothing of the sort. Leave a gap between runs.

Then read the firewall log. The most valuable outcome is not a red or green box in a browser: it is discovering that your firewall detected something and permitted it anyway, because that signature was set to monitor rather than block. That finding is common, and no browser-based tool can see it for you.

The Point

“Does my firewall detect malware?” is the question everyone asks, and it is nearly unanswerable — it depends on which malware, on what day, against which signature set.

“Can my firewall be stopped from inspecting at all?” is a better question. It has a definite answer, that answer is stable over time, and what it points at is fixable.

Test with advanced evasions and without them. The difference is your real security efficacy.