2

We have an email policy that prevents email from going through if it has password protected archive files attached. This is to protect users from viruses and trojans because the contents of the archive can't be scanned. However, this gets rather inconvenient when clients need to send us confidential data as we have to instruct them to use other methods of transfer.

So I was wondering if it's possible to set up some software that attempts to bruteforce these files using content from the body of the email? I've understood that malware using password protected files to sneak through scanning needs to include a password so the victim can open the archive and unwittingly activate the malware. If the archive doesn't open within a reasonable time the file should be deemed relatively safe if it comes from a source trusted by the recipient.

If no such solution exists or can't be created, suggestions for other reasonable solutions are welcomed as well.

2 Answers 2

5

There are many archive formats, which have many "password protection" features. It so happens that Zip archives traditionally used a custom stream cipher which has been broken. But though the break can be implemented in practice, and requires relatively few known plaintext bytes (13 to 40), its cost is still a bit high (roughly 238 elementary steps of the stream cipher). It is a nice implementation exercise for students, and an effective warning against homemade schemes, but doing it automatically in an antivirus would not be very practical.

Moreover, recent Zip implementations have switched to AES-based encryption, which is not broken.

To break through a password-protected archive, you have to "guess the password". Now let's see how this would work with malware. Such malware emails itself, automatically, to millions of people; in order to evade analysis, it encrypts itself as a password-protected archive, but, of course, this does any good (to the malware) only if the victim can still open the archive. So the victim must "guess" the password. Therefore, what malware does is that it includes the password as "text" in the email. The human victim sees the password, and uses it to open the archive.

Malware has no trouble whatsoever coming up with passwords which are random enough to defeat brute force. This prevents your "breaking attempt" strategy from being effective; in fact, if you can find the password from the antivirus then the archive is most probably not from a malware, but from an honest human (who, like many honest people, seems incapable of using strong passwords).

The strategy for archive scanning would imply "understanding" the email contents, like a human user, so as to guess the password in the same way as the victim. This is hard, because the malware just has to encode the password so that the victim "sees" it, so it can be a picture, an HTML table with pixel-sized cells (the background color of each cell is then modified to build a visible picture), an elaborate charade ("password is the capital city of Germany"),... (I have seen all of these employed). Ironically, this places the antivirus in an attack position, as if it was trying to break a CAPTCHA.

The one-line summary of all this is: it won't work.

A purely automatic antivirus software will not be able to "break through" password-protected archives which are used as malware vector. The antivirus may detect such malware through some heuristics; e.g. the presence of a password-protected archive could increase a "spam score" which, combined with other bad points from other email features, may result in a "this is spam/malware" conclusion. However, this is back to the usual trade-off: some spam/malware will get through, and some non-malware will be blocked.

Alternate strategies:

  • Block password-protected archives. Arrange for another transfer system for customers, e.g. some HTTPS-based server where files can be uploaded.

  • Delay emails with password protection until a human operator has looked at them and declared them "good" or "bad". Interns are cheap. But the extra latency can be an hindrance to business, human inspectors can fail, and having poorly paid underlings inspect emails may raise additional security issues (now your competitors know who to bribe, and that won't be expensive).

  • Implement the antivirus right on the users' desktop systems, to be run when they actually open the archive. At that point, they have typed the password, so the clear contents become available, and the antivirus may act. Of course, this has drawbacks: maintaining an efficient antivirus on all desktop systems is expensive, introduces interoperability issues, and is not feasible in some cases (e.g. in a BYOD world).

  • Request that customers protect their archives with PGP encryption, using a specific destination address and public key. The corresponding private key will be owned by the antivirus, who will then be able to scan the contents, and then forward them (internally) to the actual user within the organization (this second step needs not use encryption: the email is already on your network).

In practice you will want to use the first system, not because of all this malware-scanning problematic, but for a much more mundane reason: big emails don't travel well. A lot of email servers will drop emails which are bigger than some limit, typically around 5 megabytes. 5 MB used to be huge, but not anymore. A PowerPoint presentation with some photos will easily exceed that size. Therefore, there is pressure for using a non-email-based transfer mechanism. A Web-based upload system, with HTTPS protection, is not hard to put in place; some people use Dropbox as an extension of that principle.

1

Unless the password or the encryption scheme for the compression archive is incredibly weak, the cost of penetrating the archive files to scan them is cost prohibitive*.

A program to grab keywords or letters from the unencrypted body and attempt decryption is possible but will fail for any legit confidential email (as of course you never include the password in those emails). Assuming that the malware is unpacked from a password in the email depends on whether the malware refers to an internet link or image for the decryption password - and then you start entering AI territory.

Some alternate suggestions:

  • Require all confidential attachments to be encrypted with a public key provided by your company. Configure the malware scanner (or a pre-processing app if your scanner isn't very flexible) to attempt to decrypt every attachment with the private key of that public key. The same approach could also work on a per staff member basis, providing all relevant private keys are known by the company's malware scanner.
  • Use client-side/desktop malware scanning only. If you are really paranoid, only disable email server malware scanning for email accounts that can only be viewed/accessed from a sandbox computer that has no other account privileges and factory-resets every evening or weekend.
  • Automate email linking to a Dropbox or another pickup service.
  • Subvert your own malware scanner by sending the archive as a BMP or PNG. (This may be an unreasonable solution depending on Management vs Staff.)

* As in you need a star's computational output.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .