I work in an enterprise environment on small custom applications which read data files (usually CSVs) and integrate the data into accounting software systems. I have come across a situation where there is a server with a user always logged-in and always running Outlook. This instance of Outlook has some VBA which will download e-mail attachments, as long as the sender's domain matches a pre-defined value. The file is downloaded to a folder where a .NET app is waiting to pick up files for processing.

What are the security implications / risks of this scenario?

I imagine there is some benefit to security through obscurity. Yet, what if a file that was infected was sent and downloaded? If the .NET app only reads files with a .csv extension, can infected files be a CSV? Can it execute its malicious payload by being read by an app treating it like a comma-delimited file?

Thank you for your thoughts and guidance. I am new to this particular stack exchange and welcome any corrections to etiquette.

  • 1
    Malware can simply have a csv extension. The impacts will be up to the vulnerabilities of the .net app. – schroeder Nov 22 '16 at 18:46
  • The only thing which comes to my mind with that is protecting for SQL injection. Can you expound on other vulnerabilities? – CodenameCain Nov 22 '16 at 18:49
  • 1
    It will really depend on the app. I don't even know what it does. – schroeder Nov 22 '16 at 18:53
  • Our apps will usually do one of two things. 1) organize data for direct inserts into a SQL Server database or 2) organize data into a class object and pass to an API create method. I realize this isn't much to go on, so I am interested in broader examples of what to consider. We already think about SQL injection, but I don't know what else to think about protecting against. Can malicious services be installed in this context or would the file need to be "executed" as opposed to "read"? – CodenameCain Nov 22 '16 at 19:08

You could check the PE header of the file to ensure its actually text/csv as expected. There's a project called Mime Detective for .net that will do this for you. You could also hook into an antivirus and scan the file first if your mail service isn't doing that anyway.

Depending how you verify the sender of the mail, there is a potential of the sender address being spoofed.

If malicious content concerns you could check for sql with in the file, assuming it doesn't naturally contain keywords you could scan for those.

  • 1
    Text files don't have PE headers. Instead of "check the PE header of the file" did you mean "check if the file has a PE header"? – Ben Voigt Dec 15 '16 at 16:18
  • No, but perhaps I didn't quite mean PE either as that is portable executable. My intention was to say check the signature / magic number of the file which can reveal the file's type. there's a listof the magic bytes here on wiki en.wikipedia.org/wiki/List_of_file_signatures – iainpb Dec 16 '16 at 9:51
  • Text files don't start with a signature or magic number, either. Perhaps you meant to talk about a (purely optional) byte-order mark (Unicode U+FFFE, encoded using the file's character encoding)? – Ben Voigt Dec 19 '16 at 15:38

There is no basis for "security through obscurity", it just doesn't work. Get that out of your mind right now.

So, to answer some questions, is the .NET app just looking for an extension? Header? How does it determine the file it's loading is a CSV, that's the big one. If you just grab any file put into the folder and assume it's CSV, there are some big issues. If you're just looking for a .CSV extension, I can put .CSV at the end of any file I've created and you'd pick it up, leading to reading a virus into memory. Code could cause SQL injection if not protected against, or just plain crash the app, cause it to hang and stop processing files, crash the server by ballooning the memory, any number of things to disrupt business operations.

I think the biggest danger here is you have a VBA script downloading files onto a server automatically. That's just asking for viruses, plain and simple. The fact that it's from a certain domain doesn't protect anything, spoofing email is stupidly easy and is equal or greater risk in my opinion than your .NET app processing CSV files.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.