3

I've received an email with an attached PDF which has many signs of being a malicious attachment. Lacking the time and resources to analyze it at the moment, I'd like to store it for later use, and possibly share it with another researcher. What is the recommended process for storing this potentially malicious attachment, given that at least one mail client I use may preview the attachments before I actively click on them?

Should I use a webmail client, and download the file, then promptly zip it? Should I GPG or encrypt the file in another way, to prevent the filesystem from triggering some auto-open payload? Should I create a VM with my credentials loaded into it (seems like a potentially bad idea, should the VM be compromised) for a mail client, and download the file there?

This is different from this question, as I'm looking to store (and transfer) these potentially malicious PDFs.

If it matters, I'm considering using PDF Tools by Didier Stevens for later analysis.

Improve this question
11
  • 1
    Don't download it on a regular machine, as various services may try to access it for indexing or for previewing, which can be exploitable. But regardless, how advanced do you expect the malicious PDF to be? Who is your adversary? The answer to that will determine whether or not the answer is just to copy it with your AV enabled, or if you need to do it on a dedicated airgapped test machine.
    – forest
    Sep 3, 2018 at 3:15
  • I expect the adversary may be a reasonably skilled entity, potentially one targeting for corporate-level cyber-espionage. I doubt a nation-state level skill set, but I also can’t rule it out.
    – user3.1415927
    Sep 3, 2018 at 3:38
  • I had a previous instance of a potentially malicious pdf attached to a LinkedIn message, but after flagging the conversation, she whole thing disappeared and I lost the chance to analyze that content.
    – user3.1415927
    Sep 3, 2018 at 3:40
  • 1
    Corporate espionage is often comparable to nation-states in terms of the risks. If you are a large company or in a high-risk business, consider getting a dedicated security team that can deal with this. If in doubt, use an airgapped system for analysis.
    – forest
    Sep 3, 2018 at 3:42
  • 1
    Do not use Kali for that, it is extremely insecure, far more than most distros. It is designed for pentesting, not for surviving an exploit. It has numerous setuid binaries that make privesc easy, it runs things as root by default, its configuration is not security minded, and it does not get prompt security updates. I would strongly suggest buying a burner. With Linux, you can download the attachment from the email in command line without exposing it to any services, and then transfer it to a USB where you can analyze it on an airgapped machine.
    – forest
    Sep 3, 2018 at 3:55

1 Answer 1

Reset to default
2

Don't download it on a regular machine, as various services may try to access it for indexing or for previewing, which can be exploitable. But regardless, how advanced do you expect the malicious PDF to be? Who is your adversary? The answer to that will determine whether or not the answer is just to copy it with your AV enabled, or if you need to do it on a dedicated airgapped test machine.

Corporate espionage is often comparable to nation-states in terms of the risks. If you are a large company or in a high-risk business, consider getting a dedicated security team that can deal with this. If in doubt, use an airgapped system for analysis. Qubes OS uses virtualization for isolation, creating a new virtual machine for each application when necessary. Although it relies on Xen and a Xen 0day could easily break out of individual VMs, it can be quite secure when used on an airgapped machine.

PDF parsers are infamously insecure, so expect that it will not be difficult for an attacker of even moderate skill level to be able to achieve arbitrary code execution when the PDF is opened.

Improve this answer
2
  • Indexing, previewing and scanning for viruses - which is also a risk, the AV could have an exploit and is running with high privileges. Happened before.
    – Nobody
    Sep 3, 2018 at 6:45
  • 1
    @Nobody Indeed. The best course of action depends on the adversary. For a sophisticated adversary, AV is nothing more than a privesc vector.
    – forest
    Sep 3, 2018 at 8:54

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .