Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

You need to download an essential data file but the act of downloading carries with it the risk of contamination from say, an embedded keylogger, or worse, that can ruin your day(s) if it takes up permanent residence.

What will you do to ensure the file is good before you commit it to disk?

share|improve this question
It terribly sounds like a homework question. –  Simon Jul 19 '13 at 13:31
Well, I had to solve a similar case for a commercial venture in the past so it does have a use case, at the very least. –  Stephane Jul 19 '13 at 13:34
add comment

closed as unclear what you're asking by AJ Henderson, NULLZ, Xander, bethlakshmi, Gilles Jul 26 '13 at 19:21

Please clarify your specific problem or add additional details to highlight exactly what you need. As it's currently written, it’s hard to tell exactly what you're asking. See the How to Ask page for help clarifying this question.If this question can be reworded to fit the rules in the help center, please edit the question.

3 Answers

Solving such a problem in practice depends a bit on the nature of what you're downloading, what you will be doing with it and how soon you need the data.

If this data file is destined to be fed to a specialized program (and not accessed by a user), then a simple security measure would be to encrypt it and then save it to the disk. The program can then decrypt that file when it needs it and the "storage" will not risk accidental contamination. this assumes, however, that the "backend" program cannot be compromised by the data file itself (for instance, through some kind of buffer overflow caused by a crafted data file).

If your threat scope is wider, for instance, if you will perform the download automatically and then allow a user to access the file, then you can store the file in a database or in encrypted form for a few days and then feed it to one or more up-to-date antivirus programs.

Other measures could make some sense - like checking the format of the file early on and rejecting it if it doesn't looks like a data file - but it all depends on what you're doing precisely.

share|improve this answer
The file in question is uploaded by me to a trusted source from my computer which may be compromised. The file is then downloaded say, next day, with the hope it's not infected. I have a slightly complicated setup. –  Edwardo Jul 19 '13 at 13:58
@Edwardo - if you are uploading the file and simply want to make sure it isn't modified, generate a SHA-1 or MD5 hash of the file. There are some ways to make a collision attack against it, but it's pretty unlikely someone would go through the effort just to get to you unless you are a high value target. I updated my answer with more info. –  AJ Henderson Jul 19 '13 at 14:06
add comment

What you are asking is fundamentally impossible in the general sense. But you may be able to tell if the file is safe under a limited set of allowances.

For example, a plain text file can be guaranteed "safe" to the extent that you can also guarantee that your plain text viewer is free of any vulnerabilities or arbitrary execution paths. Your guarantee obviously doesn't extend to any other viewers though, since the potential danger in the text file is that it could trigger misbehavior in the viewer, as the text file itself cannot be executed.

As a rule, general purpose executable files can't be guaranteed safe without exploring every possible execution path of the file, which reduces down to the halting problem. If you impose specific limits on your testing -- and therefore limit the guarantees of safety you can make -- then you can make certain declarations. But those are always couched within specific limits, such as the text file example above.

share|improve this answer
add comment

Download from a reputable location. If it is a human readable format, take a look at the data and run some scans for potential exploits. If it isn't human readable, see first response unless the data file can be opened in a way that guarantees it can't be executed.

If you trust the source but are worried about it having been altered where it is stored, you can use MD5 and SHA-1 hashes of the file. While there are some methods of creating junk data that will make an altered file appear legit, it's reasonably difficult to do if the file doesn't support arbitrary data (particularly if you generate both) and is unlikely to be used against you unless you are a fairly high value target. Both hashes generate a thumbprint of the file that will let you easily detect that things have been changed.

share|improve this answer
formats are Firefox .json, ISO, various apps. From time to time my computer gets killed despite scans. The scanners screw up. –  Edwardo Jul 19 '13 at 13:43
@ AJ Henderson 99.95% of the time I run off a Live USB removed from its socket. 0.05% of the time I run the gauntlet. Yes, targeted. –  Edwardo Jul 19 '13 at 14:21
@Edwardo - are you sure you are a high value target, unless you have LARGE amounts of data that would be of high value to either governments, law enforcement or the black market then you are not likely worth the effort to generate a targeted compromised file. Your best bet is still thumbprint verification, though you could use one or more cryptographically secure hashes and use a file format with a predictable structure that would put further limits, such as compressing the data prior to upload so that alterations have to decompress validly. –  AJ Henderson Jul 19 '13 at 14:25
@Edwardo - Yes, but unless you are higher value than other people, it is far too elaborate of an attack to put the resources in to. The majority of non-targeted criminal hacking is very basic and those that are doing custom exploits are looking for big payoffs, not going after individuals. Forging a thumbprint for multiple hashes in a structured file is quite complex and computationally pricey. It isn't something joe blow scriptkiddie is gonna do to try and get in to random bloke's computer. –  AJ Henderson Jul 19 '13 at 14:47
Exploit scanning will never detect more than a small percentage of threats. Bypassing all exploit scanners is a trivial task for malicious actors. –  tylerl Jul 19 '13 at 18:53
show 3 more comments

Not the answer you're looking for? Browse other questions tagged or ask your own question.