1

We have a requirement to handle PDF's by external entities & these PDF's go to our internal network. The internal network from this view-point isn't obviously totally isolated.

We thought to use the VirusTotal API after initial research & get these docs scanned before having them go towards the internal network. Virus total is a service and we will end up sending our documents to an external org i.e. VirusTotal & that's something the stakeholders do not approve of.

Things we are looking for as a medium scale company requirement:

  1. At this point we cannot afford an enterprise solution. We have tried opensource solutions; however these solutions fail at detecting malware which is crafted & isn't always reliable.
  2. A set of instruction to have a middle-man solution where-by the docs need not be sent to an external org & at the same time, the solution should be able to detect threats efficiently.

How do we handle the threat as threat surface is the requirement functionality & as tested by our malware team that many PDF's could be having embedded malware which if executed can open up a back connection to unknown hosts? IPtables, firewalls etc are fine .. but if it however doesn't connects to any system & instead does malicious activities such as delete sys files, etc .. that would be another problem.

Edit 1: As per comments, one raised questions were, where did the PDF get channelized from. It's evident from the OP itself that the link is TCP/IP connection via an upload functionality which is then taken to an internal server (pseduo-internal, as it has one external opening access).

  • I don't understand your question. Either you have a "malware team" who will define how you should these PDFs (and then, your question should rather go to serverfaut or stackoverflow for how to implement it) or you don't and your asking the wrong question. – Stephane Oct 20 '16 at 10:22
  • I am afraid the answer should be more specific. There is many ways you receive a pdf file or other kinds of files, like through email, usb, ftp servers etc For each of these ways you should have specific solutions. If you receive the file from the usb port, a good updated antivirus should do the job. If you receive the file via mail, the mail server antivirus should do the job etc. – Vini7 Oct 20 '16 at 11:12
  • Not all mail servers handle the malware. The ones which are inbuilt aren't just proven enough to detect. – Shritam Bhowmick Oct 20 '16 at 11:57
  • OK, but in which manner do you recive the PDF files? – Vini7 Oct 20 '16 at 12:04
  • @Vini7 I have had updated the post. These are via upload forms on external sites & then taken to an internal server. It's a isolated server from rest of the functionality. – Shritam Bhowmick Oct 20 '16 at 12:08
1

The easiest way to deal with probably malicious PDF containing active content is to convert them into a format where active content is not possible. This might be printing and scanning, converting to an image or converting to postscript - the last one probably preserves most of the content but not the active content. Note that converting is best done within a secured environment (VM, sandbox...) so that the conversation itself does not result in compromise. There are several tools which you can do such conversation, including the free ghostscript.

Of course this way every active content is removed. This might be a problem in your environment with unknown requirements if you need to deal with PDF based forms etc.

  • These are some valid points. Many thanks to share them across. Conversion on a sandbox could be one approach. Still open to new approaches. – Shritam Bhowmick Oct 20 '16 at 11:59
0

I am not sure whether the answer can be your case, but you could load the pdf on dropbox (for example) and read the content through the browser, without downloading it and open then the pdf with a software running on your device. What do you think?

  • that would break the procedure .. which is by default stakeholders do not want to push the pdf's to any external org & handle it internally. The sensitivity of PDF is much more than any other data & dropbox was once compromised. It could eventually always repeat. – Shritam Bhowmick Oct 20 '16 at 14:36

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.