2

I work in an enterprise environment on small custom applications which read data files (usually CSVs) and integrate the data into accounting software systems. I have come across a situation where there is a server with a user always logged-in and always running Outlook. This instance of Outlook has some VBA which will download e-mail attachments, as long as the sender's domain matches a pre-defined value. The file is downloaded to a folder where a .NET app is waiting to pick up files for processing.

What are the security implications / risks of this scenario?

I imagine there is some benefit to security through obscurity. Yet, what if a file that was infected was sent and downloaded? If the .NET app only reads files with a .csv extension, can infected files be a CSV? Can it execute its malicious payload by being read by an app treating it like a comma-delimited file?

Thank you for your thoughts and guidance. I am new to this particular stack exchange and welcome any corrections to etiquette.

Improve this question
4
  • 1
    Malware can simply have a csv extension. The impacts will be up to the vulnerabilities of the .net app.
    – schroeder ♦
    Nov 22, 2016 at 18:46
  • The only thing which comes to my mind with that is protecting for SQL injection. Can you expound on other vulnerabilities?
    – CodenameCain
    Nov 22, 2016 at 18:49
  • 1
    It will really depend on the app. I don't even know what it does.
    – schroeder ♦
    Nov 22, 2016 at 18:53
  • Our apps will usually do one of two things. 1) organize data for direct inserts into a SQL Server database or 2) organize data into a class object and pass to an API create method. I realize this isn't much to go on, so I am interested in broader examples of what to consider. We already think about SQL injection, but I don't know what else to think about protecting against. Can malicious services be installed in this context or would the file need to be "executed" as opposed to "read"?
    – CodenameCain
    Nov 22, 2016 at 19:08

2 Answers 2

Reset to default
1

You could check the PE header of the file to ensure its actually text/csv as expected. There's a project called Mime Detective for .net that will do this for you. You could also hook into an antivirus and scan the file first if your mail service isn't doing that anyway.

Depending how you verify the sender of the mail, there is a potential of the sender address being spoofed.

If malicious content concerns you could check for sql with in the file, assuming it doesn't naturally contain keywords you could scan for those.

Improve this answer
3
  • 1
    Text files don't have PE headers. Instead of "check the PE header of the file" did you mean "check if the file has a PE header"?
    – Ben Voigt
    Dec 15, 2016 at 16:18
  • No, but perhaps I didn't quite mean PE either as that is portable executable. My intention was to say check the signature / magic number of the file which can reveal the file's type. there's a listof the magic bytes here on wiki en.wikipedia.org/wiki/List_of_file_signatures
    – iainpb
    Dec 16, 2016 at 9:51
  • Text files don't start with a signature or magic number, either. Perhaps you meant to talk about a (purely optional) byte-order mark (Unicode U+FFFE, encoded using the file's character encoding)?
    – Ben Voigt
    Dec 19, 2016 at 15:38
1

There is no basis for "security through obscurity", it just doesn't work. Get that out of your mind right now.

So, to answer some questions, is the .NET app just looking for an extension? Header? How does it determine the file it's loading is a CSV, that's the big one. If you just grab any file put into the folder and assume it's CSV, there are some big issues. If you're just looking for a .CSV extension, I can put .CSV at the end of any file I've created and you'd pick it up, leading to reading a virus into memory. Code could cause SQL injection if not protected against, or just plain crash the app, cause it to hang and stop processing files, crash the server by ballooning the memory, any number of things to disrupt business operations.

I think the biggest danger here is you have a VBA script downloading files onto a server automatically. That's just asking for viruses, plain and simple. The fact that it's from a certain domain doesn't protect anything, spoofing email is stupidly easy and is equal or greater risk in my opinion than your .NET app processing CSV files.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .