Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

As a user of PGP I worry about receiving a virus that was previous encrypted with my public key, which anybody can get by querying many PGP key servers. What prevents an attacker to target a PGP user by sending a virus encrypted with the user's PGP public key? AV scanners operating at the mail-server level would not be able to detect such virus.

share
2  
The answer is: they dont, antivirus is easy to bypass anyway, it's main role to deal with cheap little viruses and it's not a reliable defence at all. You should not use email as well deal with sensitive data on the same OS/Account/User/Security context. –  Andrew Smith Jun 30 '12 at 9:47

1 Answer 1

What you've described is only a problem for network-based Antivirus systems, and I don't believe there is currently a way for such systems to detect encrypted malware if they are utilizing a signature based detection algorithm.

I believe the solution here is to implement a good host-based Antivirus program that can perform real-time AV analysis as files are being accessed, and consequently would detect any known viruses after the e-mail was decrypted. Of course, you'd also want to disable displaying images inline or otherwise interacting with file attachments automatically after decryption. Norton Antivirus and Intego Virus Barrier are two examples of products that can offer real-time, host-based virus detection.

Theoretically, you might still be vulnerable to malware that targets the PGP decryption implementation used on your system. This seems like an extremely low probability, but if you were concerned about it you could mitigate the risk by only checking PGP e-mail within a Virtual Machine on your system.

share

This site is currently not accepting new answers.

Not the answer you're looking for? Browse other questions tagged .