1

Is it possible to infect a file encrypted using GnuPG?

For example, if I had an encrypted file on an unsecured public ftp server, would someone be able to copy that file and attach a virus/trojan onto the file and then reupload to the server? Then when I next accessed/decrypted, I would then be infected with said virus?

I am currently storing encrypted files on public servers to store data that a few people access. I have just had a sinking feeling that I could be open to attack and possibly have this encrypted data leaked if a trojan was installed.

Improve this question
6
  • You mean, is it possible to modify an encrypted file and the file still be able to be decrypted? The answer to that is "no".
    – schroeder ♦
    May 1, 2016 at 20:41
  • Not even if they remove the original file then encrypt an infected file using my public key? If they encrypted an infected pdf to my public key wouldnt it encrypt and decrypt without any issues?
    – Freeman
    May 2, 2016 at 9:00
  • It depends on how you are encrypting it, hence my question. If you have an encrypted file that someone can decrypt, modify then re-encrypt, then yes, the file can be infected. Is that what you are asking?
    – schroeder ♦
    May 2, 2016 at 14:55
  • No what i mean was for example, on my server i have uidInfo.gpg, which contains an file called password.pdf. Could someone remove the uidInfo.gpg and replace with their own file name uidInfo.gpg which is encrypted to my public key and inside have a password.pdf file with virus attached?
    – Freeman
    May 2, 2016 at 19:10
  • it depends on how you encrypted the gpg file
    – schroeder ♦
    May 2, 2016 at 19:14

1 Answer 1

Reset to default
1

Malware can be distributed in various fashions: as directly executable programs, or hidden in other files and formats used as containers.

If you apply a process that always decrypts a given file, replacing it with directly executable malware is not very promising, decryption will simply fail. In case of public/private key cryptography (and a known public key), of course the encrypted file could be exchanged by another, malicious file. Signing mitigates this, symmetric encryption also does (as there is no "public" key).

On the other hand, there might always exist a bug in the software reading a file: the question "How to inject executable, malicious code into PDF, JPEG, MP3, etc.?" contains some examples. A similar bug could also exist in GnuPG, triggered on decryption or verification of a signature. In this case, a malicious OpenPGP message might result in malware being executed on your computer. If a trojan is run on your computer, obviously also the encrypted content might be revealed.

Improve this answer
4
  • Right yes that makes things more clear. So if the file isnt digitally signed, someone who has my public key could reupload an infected version of my encrypted file?
    – Freeman
    May 1, 2016 at 21:33
  • He could do so anyway; but a digital signature enables you to realize the file wasn't issued by yourself (missing or wrong signature, or signature issued by another key).
    – Jens Erat
    May 1, 2016 at 21:59
  • Thanks. I didnt think I would be able to open an encrypted file that wasnt encrypted using my public key. I thought they would have to add my public key so I could decrypt.
    – Freeman
    May 1, 2016 at 22:08
  • You won't be to decrypt it, but GnuPG has to start processing the file to realize so. Anyway, usually public keys are public, and available to anyone.
    – Jens Erat
    May 2, 2016 at 7:43

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .