0

I want to connect a known to be compromised Windows machine to the network for file sharing, it has lots of pirated software installed therefor not secure. Can it be isolated so that nothing can propagate on the network and compromise other (linux) machines or do other things on the network? I only want to share images, videos, and some project files of professional (pirated) software, not executables of any kind. Would scanning shared folder for viruses/malware be enough for reasonable security?

How sandboxing protocols deal with such kind of things, when at least one folder has to be shared between the systems, and is likely to be/come compromised?

3
  • 2
    You have a mixed bag of things you want to protect against, but you appear to speak of them as the same, single thing. 1. A compromised machine "doing something" on the network. 2. the shared files being infected. 3. The share itself being compromised.
    – schroeder
    May 11 at 11:49
  • "Sandboxing" means that the files are only viewed or executed on the remote machine.
    – schroeder
    May 11 at 11:51
  • If one of your Linux machines has a spare network port, you could set that machine up as a firewall, and block everything except port 80 on a specific IP address. (or rather, I got the direction backwards, so install a web server on the shady box and other machines connect to it)
    – user253751
    May 11 at 13:59

1 Answer 1

0

If the machine is untrusted, it should not be connected to the network. If you know that it could have malware on it and are unsure of the actual malwares, connecting it to the network could open unknown breaches to attackers: what if it can act as a relay by opening one connection to a rogue site and having the attacker inside your network? What if it contains rootkits hiding under common names?

If you only need to extract a limited number of files, a possible way if to pass through a clean box:

  • setup a machine with as few software as possible but holding the best anti-maware you can install on it
  • extract the files you want to use from the possibly compromised machine on a just formatted removable media
  • mount that media on the clean box and control that no known malware is detected - of course if something is detected the clean box should immediately be fully erased and re-installed from scratch.

From that point, you cannot be sure that the media does not contain harmfull content, but at least you have done your best to detect it. You will have to balance between the risk of undetected malware (should be low if you used good reputation tools on the clean box), the value of the extracted files, and the sensitiveness of other elements on the network (only you hollidays photos or nuclear weapon codes?)? The good old risk/gain balance...

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.