Malicious email attachments analysis

Question

I have a question regarding incoming emails with malicious attachments on my email server. So, my idea, in my ideal setup, is to have a machine aside running virtualization software. This would run all the tools needed to do the malware analysis where I would send the supposed malicious attachments to from another system where the suspicious email would have been seen.

Now, the question is:

What would be the ideal mechanism to use to transport the suspicious attachments from the email client to the analysis system with a minimum amount of interaction with the file, in order to minimize the risk of infection on the primary system?

Answer 1

Encrypt it.

As soon as you identified the file as malicious, encrypt it with a keypair where the private key is on the analysis VM and don't decrypt it until you have it in the save environment where you want to analyze it.

As soon as the file is encrypted, no device in between will be able to do anything with it, no matter what they try. So it's now safe to use whatever file transfer mechanism you consider most convenient.

Possible weakness: A bug in the encryption software itself which can be exploited when a malicious file is encrypted. But considering that most encryption systems are quite simple and quite rigorously tested I would consider that unlikely.

Answer 2

This is difficult. If you send them to a sandbox (by encrypting them like Philipp suggests), how then do you transmit the email if it turns out not to be malicious? You can't send it back from the sandbox because other emails may have infected it.

However if you store it on the mail server while waiting for the analysis results, you could get infected.

I would suggest therefore to store the emails in containers (which are encrypted with a key of the mail server) while waiting for the sandbox results, and if they aren't malicious to fetch the e-mails out.

The ideal solution would be to have a sandbox for each malicious e-mail (which would allow you to send the e-mails out of the sandbox if they pass your analysis) but that would take too much computational power (it makes more sense to have a set of sandboxes which revert to snapshots every 5 minutes for example or each time malware has been discovered).