I'm facing an issue which i need to upload files to a centralized server, then relay it to other malware analysis providers (Palo Alto / etc...)
As from security perspective - it's forbidden for the file to reside in the server's file system and memory.
The server is ASP.NET based, and the client is C++ and i thought about streaming (currently we stream those files through IIS) - but i have some major drawbacks:
- I think that IIS can cache data it receives, meaning - i have no control on the data flow (malware can suddenly reside in IIS memory).
- Even if i use TCP components - who said that there's no caching in the server side? I would hate to write the entire TCP handling myself (which never will be efficient like the already written ones)
- Other option i was thinking is to XOR the files, but if i do it on agent - compromised machine can manipulate it and send the original malware, and in server again, it could be that the malware is already cached in memory.
In addition to #3, XOR, or any password protected zip files methods (that client can send) are no acceptable aswell, as exploits might be used to decrypt this file in the server and run it (though those are slim chances).
The 3rd parties we use also expect the original file's data.
The only "acceptable" solution is to sandbox the receiving process with its files, either by a 2nd server (which is not acceptable by our on-premise customers) or in our "real" server (some kind of container - which seems like a super overkill)
Would love to hear your comments about this?