1

We have a requirement to handle PDF's by external entities & these PDF's go to our internal network. The internal network from this view-point isn't obviously totally isolated.

We thought to use the VirusTotal API after initial research & get these docs scanned before having them go towards the internal network. Virus total is a service and we will end up sending our documents to an external org i.e. VirusTotal & that's something the stakeholders do not approve of.

Things we are looking for as a medium scale company requirement:

  1. At this point we cannot afford an enterprise solution. We have tried opensource solutions; however these solutions fail at detecting malware which is crafted & isn't always reliable.
  2. A set of instruction to have a middle-man solution where-by the docs need not be sent to an external org & at the same time, the solution should be able to detect threats efficiently.

How do we handle the threat as threat surface is the requirement functionality & as tested by our malware team that many PDF's could be having embedded malware which if executed can open up a back connection to unknown hosts? IPtables, firewalls etc are fine .. but if it however doesn't connects to any system & instead does malicious activities such as delete sys files, etc .. that would be another problem.

Edit 1: As per comments, one raised questions were, where did the PDF get channelized from. It's evident from the OP itself that the link is TCP/IP connection via an upload functionality which is then taken to an internal server (pseduo-internal, as it has one external opening access).

Improve this question
5
  • I don't understand your question. Either you have a "malware team" who will define how you should these PDFs (and then, your question should rather go to serverfaut or stackoverflow for how to implement it) or you don't and your asking the wrong question.
    – Stephane
    Commented Oct 20, 2016 at 10:22
  • I am afraid the answer should be more specific. There is many ways you receive a pdf file or other kinds of files, like through email, usb, ftp servers etc For each of these ways you should have specific solutions. If you receive the file from the usb port, a good updated antivirus should do the job. If you receive the file via mail, the mail server antivirus should do the job etc.
    – Vini7
    Commented Oct 20, 2016 at 11:12
  • Not all mail servers handle the malware. The ones which are inbuilt aren't just proven enough to detect.
    – Shritam Bhowmick
    Commented Oct 20, 2016 at 11:57
  • OK, but in which manner do you recive the PDF files?
    – Vini7
    Commented Oct 20, 2016 at 12:04
  • @Vini7 I have had updated the post. These are via upload forms on external sites & then taken to an internal server. It's a isolated server from rest of the functionality.
    – Shritam Bhowmick
    Commented Oct 20, 2016 at 12:08

2 Answers 2

Reset to default
1

The easiest way to deal with probably malicious PDF containing active content is to convert them into a format where active content is not possible. This might be printing and scanning, converting to an image or converting to postscript - the last one probably preserves most of the content but not the active content. Note that converting is best done within a secured environment (VM, sandbox...) so that the conversation itself does not result in compromise. There are several tools which you can do such conversation, including the free ghostscript.

Of course this way every active content is removed. This might be a problem in your environment with unknown requirements if you need to deal with PDF based forms etc.

Improve this answer
1
  • These are some valid points. Many thanks to share them across. Conversion on a sandbox could be one approach. Still open to new approaches.
    – Shritam Bhowmick
    Commented Oct 20, 2016 at 11:59
0

I am not sure whether the answer can be your case, but you could load the pdf on dropbox (for example) and read the content through the browser, without downloading it and open then the pdf with a software running on your device. What do you think?

Improve this answer
1
  • that would break the procedure .. which is by default stakeholders do not want to push the pdf's to any external org & handle it internally. The sensitivity of PDF is much more than any other data & dropbox was once compromised. It could eventually always repeat.
    – Shritam Bhowmick
    Commented Oct 20, 2016 at 14:36

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .