2

Considering Linux's reputation for being somewhat immune to infections, and the fact that most malware are written with Windows as a target, is it safe to open possibly infected files on a Linux system?

I am aware of the more general ways of checking for an infection (rkhunter, chkrootkit, etc), but I also know these don't help if the infection somehow compromises them. What are the ways this can happen and how likely are these?

Since there is a difference in the structure and architecture between a PC and the Raspberry Pi, would using a Pi to open files and/or for forensic analysis add a layer of security?

I'm asking for systems air-gapped and isolated, so for the most part, only concerning infections and malware that might be hidden inside other files or passed through removable devices.

  • What do you mean with "open"? View inside a simple editor or have some complex software process the file? – Steffen Ullrich Aug 24 '18 at 9:47
  • I was mostly thinking files like images, videos, documents, etc, so the latter, I think. – user942937 Aug 24 '18 at 9:50
  • I did not ask what kind of files you want to open but how do you want to open these. One might open an image in a hex editor to look for suspicious meta data. One might also look at it in an image viewer to actually view the image. Applications like image viewers, video players and office programs are complex and often buggy, this is true for Linux too. But if you use a throw-away read-only and non-networked system with a more unusual and thus less targeted CPU (i.e. ARM) then you need to worry less compared to using a read-write Windows or Linux system. – Steffen Ullrich Aug 24 '18 at 10:08
1

Not necessarily. First of all you need to identify the platform the malware is made for. If it's made to target linux, your argument is totally invalid. Secondly, there are two types of analysis that you can perform - dynamic and static. Dynamic involves running the code in a secure environment and understanding its behavior. Static analysis is mostly code examination in assembly for most executables, unless java or .Net. So, you need to identify the malware, set up a linux and a windows environment in vm's with the proper tools (diasassemblers, hex editors etc.) and find out more info the hard way. You can also set up Cuckoo, it's a very good sandbox which does automated dynamic analysis, both on windows and linux. Takes time to set up, saves lots of time in the aftermath!

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.