2

Considering Linux's reputation for being somewhat immune to infections, and the fact that most malware are written with Windows as a target, is it safe to open possibly infected files on a Linux system?

I am aware of the more general ways of checking for an infection (rkhunter, chkrootkit, etc), but I also know these don't help if the infection somehow compromises them. What are the ways this can happen and how likely are these?

Since there is a difference in the structure and architecture between a PC and the Raspberry Pi, would using a Pi to open files and/or for forensic analysis add a layer of security?

I'm asking for systems air-gapped and isolated, so for the most part, only concerning infections and malware that might be hidden inside other files or passed through removable devices.

3
  • What do you mean with "open"? View inside a simple editor or have some complex software process the file? Commented Aug 24, 2018 at 9:47
  • I was mostly thinking files like images, videos, documents, etc, so the latter, I think.
    – user942937
    Commented Aug 24, 2018 at 9:50
  • I did not ask what kind of files you want to open but how do you want to open these. One might open an image in a hex editor to look for suspicious meta data. One might also look at it in an image viewer to actually view the image. Applications like image viewers, video players and office programs are complex and often buggy, this is true for Linux too. But if you use a throw-away read-only and non-networked system with a more unusual and thus less targeted CPU (i.e. ARM) then you need to worry less compared to using a read-write Windows or Linux system. Commented Aug 24, 2018 at 10:08

2 Answers 2

1

Not necessarily. First of all you need to identify the platform the malware is made for. If it's made to target linux, your argument is totally invalid. Secondly, there are two types of analysis that you can perform - dynamic and static. Dynamic involves running the code in a secure environment and understanding its behavior. Static analysis is mostly code examination in assembly for most executables, unless java or .Net. So, you need to identify the malware, set up a linux and a windows environment in vm's with the proper tools (diasassemblers, hex editors etc.) and find out more info the hard way. You can also set up Cuckoo, it's a very good sandbox which does automated dynamic analysis, both on windows and linux. Takes time to set up, saves lots of time in the aftermath!

0

"Safe" is relative. The answer depends on what kinds of files you're dealing with and how confident you are that they don't affect Linux.

Binary Files - Easy to determine target platform

Binary files are generally specific to OS and processor architecture, so using a different OS from the one targeted can help reduce the risk of malware infection. For example, if your malware is a PE file (Windows Portable Executable, e.g. .exe, .dll, etc), chances are it won't be able to do much on Linux. Conversely, if your potentially malicious file is an ELF binary (Executable and Linkable Format), it won't be able to do much on Windows.

In this case, since it won't run on the wrong platform, all this practice does is help to reduce the risk that a binary is accidentally run. If you intend to run a potentially malicious binary, you will need to use a compatible platform.

Scripts and Interpreted Code - Harder to determine target platform

Certain scripts can be dangerous across multiple platforms. For example, Python could be used as an initial infection vector to check the OS and establish persistence by downloading corresponding malware.

While these kinds of scripts can be read, some scripts can be heavily obfuscated (these are almost guaranteed to be malicious) or may contain large amounts of code that can make it difficult to identify malicious features.

Documents and Other Files - Very difficult to determine target platform

Malicious Documents will usually target a specific application and either take advantage of legitimate features in an application used to view them (like with Macro Malware for Microsoft Office products) or exploit vulnerabilities in the application used to view them. It may not be as clear what platform or application the malicious document is intended to exploit.

Viewing potentially malicious documents

If your goal is to simply view potentially malicious documents, you can use a non-persistent system which is not networked. That way, it won't matter if it gets infected since you can just reset it.

Keep in mind, removable media could add an element of persistence, so if that's how you're getting the files into the environment you may want to consider keeping copies of the original files and wiping the drive after each use (or use media that has a physical write-protect mechanism, like SD cards).

Detecting malware infections with tool "X"

Be careful about assuming any tool can guarantee a system is or isn't infected. There are many ways to infect a system. The tools you mentioned (rkhunter, chrootkit) would primarily help if the system was infected with a known rootkit ("known" meaning it has been seen before and analyzed). Most other malware detection tools are also based on known signatures / IoCs (Indicators of Compromise). ClamAV may be another tool to consider.

Since your environment is airgapped, you may also want to consider how you intend to update the signature databases for your anti-malware tools.

Dynamic malware analysis techniques may help if you intend to open potentially malicious files and want to know if the system is infected afterwards, though when you're dealing with potential malware it's always best to make sure you don't mind infecting the system.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .