4

We get a lot of spam/phishing emails with suspicious attachments and i will like to know the best way to submit this for analysis without getting your own system infected.

I currently save the file locally and then upload to a site like virustotal, malwr.com or mcafee. but i feel its possible malware can execute based on copy and paste. Please help

2

I don't think you have to worry about malware running from within the clipboard, unless you're manually pasting commands in an attached file into your terminal.

I guess they could try to read/write to the clipboard via some browser, see here https://stackoverflow.com/questions/5551338/how-to-read-clipboard-data-in-cross-browser

On a more serious note, a general rule of thumb when dealing with malware is to do so in an isolated environment, such as within a virtual machine with limited access to its host, and if it has an internet connection, maybe add firewall rules so that it can only ever connect to a white-listed analysis website.

One of my favorite "hacking" scenes in any movie was in the bond movie, Skyfall. In the film, the young and (apparently) foolish Q decides that it is perfectly safe to plug in the villain Raoul Silva's laptop into MI6's network with a direct connection to his personal work machine. And then they wondered why Silva was able to hack them in the first place...

As you've probably discovered, whenever you're dealing with a foreign object on a network, the best way to deal with it is to keep it quarantined. Whether that means ignoring spam emails or trying to open them in a virtual environment is up to you. Personally, I'd opt for the former.

1

The best way would be to use Linux Virtual Machine with Desktop Environment.

You logon to it remotely with Windows/Linux X2GO Client via SSH onto XFCE Fedora desktop (it works with X2GO best) where you can have Google Chrome or Firefox to upload it.

If you use Fedora, you can keep SELinux on, and also use sandbox utility for e.g. Firefox to prevent it from accessing any other locations than dedicated folder.

You just keep on having updates and recreate user once a while as well. Doing it on Windows system without AV software is highly risky. With Linux it's a lot less risky. On Windows one mistake can make issues to your own desktop. Virtual machine can be reinstalled. It's harder to install Windows as virtual machine because of licensing issues (sometimes actually you might have some free license in Hyper-V).

You can create such virtual machine in many ways:

  1. On demand cloud server in AWS or similar with Fedora, even cheap VPS would do, however this one can expose your corporate secrets to 3rd party.
  2. Corporate VMWare, Xen or KVM
  3. Hyper-V on Windows 10
  4. VirtualBox on Windows7 (though it's the worst option as it will bloat your desktop)

With X2GO you can securely connect to it and work with Desktop Environment. You can even configure email client on it and since it's not Outlook it is also a lot safer.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.