0

Is it safe to configure the antivirus to automatically copy the file from the quarantine to a network share?

The antivirus should copy the encrypted archive (with password intact) from the quarantine to a folder. The objective is to analyse the malicious file with external tools (online sandbox).

Is there any best practice to realize that process? Is there any risk that the server in which the archive is exported from the quarantine is going to be infected?

1
  • 2
    Files that are not run cannot infect. Only when the file is interacted with, by human or machine, is there a possibility for infection. Just writing bits to disk does not infect anything. (especially if encrypted).
    – schroeder
    Commented Nov 28, 2022 at 12:47

1 Answer 1

1

It becomes risky at the point where the file is decrypted to become examined.

Unless the attacker knows your decryption tools, and your decryption tools have an exploitable bug. Basically, a harmless but suspicious file could be encrypted safely, but then trigger a bug in the decryption tool.

Or your operating system is stupid and can be made to launch the contents of a file as soon as it becomes decrypted. Something like Windows "autorun" but for the output of the decryption tool.

A decryption tool should be very simple and make such an attack impossible. (It may be difficult to make the decryption tool decrypt correctly, but since the output could be anything, decryption errors wouldn't cause any additional problems).

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .