uOS - Anti-Malware SHA256 Malware Signature Support

Zyxel_Claudia

Anti-Malware - SHA256 Support

To align with modern security standards, Zyxel Networks has added SHA256 hash support for malware signatures in version 1.37. SHA256 is now the primary hash function used by most security vendors, replacing the older MD5 standard.

Processing Efficiency

The firewall's behavior changes depending on the configuration of the MD5 list:

• Optimized Performance: If the MD5 allow or block list is left blank, the firewall skips MD5 calculations entirely and proceeds directly to the SHA256 local cache. This results in faster processing and reduced CPU overhead.
• Dual Processing: If MD5 entries are present, the firewall is forced to calculate both MD5 and SHA256 hashes for incoming files, which adds processing latency.
  
  

Implementation Details

SHA256 signatures can be imported into both allow and block lists. For incoming traffic, the sequence typically involves checking the allow or block list first, followed by anti-malware signatures, local cache, sandbox, and eventually cloud-based queries. By default, SHA256 is calculated for selected file types when anti-malware is enabled.

Verification Log