Timeline for What is the safest way to deal with loads of incoming PDF files, some of which could potentially be malicious?
Current License: CC BY-SA 3.0
10 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Feb 14, 2017 at 13:55 | history | edited | FatSecurity | CC BY-SA 3.0 |
deleted 477 characters in body
|
| Feb 14, 2017 at 13:53 | comment | added | FatSecurity | @ChrisH You're right, it's not bulletproof. A Sandbox is the better solution. I changed my answer to reflect that. | |
| Feb 14, 2017 at 13:13 | comment | added | Chris H |
@AntivirusExpert but pdfs are perfectly capable of having content change randomly on the fly to defeat this sort of scanning (as has been done for years or even decades in .exe etc. malware). I've just tested and you can replace header data using something as trivial as sed; this would change the MD5sum. You would have to assume that a malware creator could and would do that. Not to mention that the source might make it unique in this threat model
|
|
| Feb 14, 2017 at 11:39 | review | Low quality posts | |||
| Feb 14, 2017 at 11:45 | |||||
| Feb 14, 2017 at 10:35 | comment | added | FatSecurity | That's why I say it's not bulletproof, but then again - if someone is attempting to infect you with malware they might not go through the effort of creating a unique file for you. Changing the file name won't result in a different MD5 hash, only changing the file's content. | |
| Feb 14, 2017 at 10:32 | comment | added | Tom the journalist | But the PDF would be unique, it most probably wont be in virustotal database. Thanks for your clarifications regarding the sandbox, I will look into that. | |
| Feb 14, 2017 at 10:31 | history | edited | FatSecurity | CC BY-SA 3.0 |
added 514 characters in body
|
| Feb 14, 2017 at 10:29 | comment | added | FatSecurity | Regarding VT - when you convert the file to a hash, it's a one way conversion and VT doesn't receive your files. It's not bulletproof from malware (because not all hashes are known to VT), but it's bulletproof from leaking. Regarding the sandbox solution: a sandbox is a virtual environment which you can create and remove at will, like a virtual desktop where you can do anything and then reset it back to the initial stage. Infected? Just reset. Avast antivirus (paid version) for example has a sandbox solution which allows you to right click on the file and open it in a sandbox. | |
| Feb 14, 2017 at 10:24 | comment | added | Tom the journalist | I mentioned virustotal in the post and why it's not convenient for this type of work. Your second proposal is interesting, can you please add more details to it? | |
| Feb 14, 2017 at 10:20 | history | answered | FatSecurity | CC BY-SA 3.0 |