Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

As a user of PGP I worry about receiving a virus that was previous encrypted with my public key, which anybody can get by querying many PGP key servers. What prevents an attacker to target a PGP user by sending a virus encrypted with the user's PGP public key? AV scanners operating at the mail-server level would not be able to detect such virus.

share|improve this question
The answer is: they dont, antivirus is easy to bypass anyway, it's main role to deal with cheap little viruses and it's not a reliable defence at all. You should not use email as well deal with sensitive data on the same OS/Account/User/Security context. – Andrew Smith Jun 30 '12 at 9:47

What you've described is only a problem for network-based Antivirus systems, and I don't believe there is currently a way for such systems to detect encrypted malware if they are utilizing a signature based detection algorithm.

I believe the solution here is to implement a good host-based Antivirus program that can perform real-time AV analysis as files are being accessed, and consequently would detect any known viruses after the e-mail was decrypted. Of course, you'd also want to disable displaying images inline or otherwise interacting with file attachments automatically after decryption. Norton Antivirus and Intego Virus Barrier are two examples of products that can offer real-time, host-based virus detection.

Theoretically, you might still be vulnerable to malware that targets the PGP decryption implementation used on your system. This seems like an extremely low probability, but if you were concerned about it you could mitigate the risk by only checking PGP e-mail within a Virtual Machine on your system.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.