0

Situation: Using Python to make a simple quarantine software for malware.

What I know:

I do understand (from this forum no less) that one of the ways is to put the file in a quarantine directory and turn off all access to it (i.e. 0000 Linux file permissions).

Another way is to scramble the binary such that it cannot be executed when "double clicked", but can be unscrambled should the user decides that the file is safe and wants it back.

Problem: I am not convinced that quarantining files are just as simple as that.

Question: What are some other ways that antiviruses use to quarantine files that I can use?

Additional information: Do avoid proprietary methods, as this method will be deployed in my code.

1

Let me explain a mechanism that we used on the past on a commercial AV that I was working on:

  1. The AV engine detects the malware.
  2. We create a new file with a header with meta information (timestamp, malware name, sha of the file, and so on) and after the header the original file. By doing this, we didn't care about the permissions of the file and by executing accidentally or things like that.

This was working for us and might give you an idea of what you can do in your implementation.

  • So technically what you did was to change the file type such that it is no longer an executable? – Timothy Wong Jan 26 '18 at 8:20
  • No, what we did was to create a new file with header + infected_file and remove the infected_file. So in case of execute the new file, because have a non ELF of EXE header, you can not execute it accidentally. – camp0 Jan 26 '18 at 8:52

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.