2

There's a file processing service that looks for some know attacks and sometimes returns messages like:

Probably harmless! There are strong indicators suggesting that this file is safe to use.

Are there heuristics that model the likelihood that a file is harmless, and if so, what is a simple example of such a heuristic, and what is the best way to learn more about the topic in general?

2
  • 1
    Sample heuristic: .TXT file containing only ASCII with a proper byte order mark. Commented May 18, 2014 at 20:19
  • +1 Right, that's the only thing I was able to think of too.
    – blunders
    Commented May 18, 2014 at 21:19

1 Answer 1

2

Likely heuristics are:

  • File is a valid file of a known type (eg. a JPEG that falls within a strict reading of the JPEG spec).
  • File does not contain any extraneous data (eg. JPEG permits unformatted data after the image. A safe file would not have any.)
  • File does not contain any known exploits for the format.

Other possible heuristics:

  • File does not use unusual features of the format (eg. a JPEG that uses unusual application-specific markers would be considered suspicious).
  • File does not appear to embed data of a different type (eg. a JPEG with something that looks like HTML in the comment field could be an attack on the Internet Explorer type-sniffing mechanism, though this is prone to false positives).

For learning more about this, I'd recommend reading up on the specs on a few file formats, and looking for exploits involving those formats.

8
  • You forgot 3. This 'file processing service' is actually a scam to reassure gullible users into installing 'virus-free' malware. Commented May 19, 2014 at 6:49
  • @Shadur: Unclear what you mean by "[it] is actually a scam to reassure gullible users into installing virus-free malware." What do you mean?
    – blunders
    Commented May 19, 2014 at 11:43
  • @blunders Story time! I occasionally play an MMO named Warframe. Good fun, has a number of microtransacty things, lots of depth for a third person space ninja shooter. Couple weeks ago I got followed on Twitter by an obvious bot that advertised 'free platinum' (plat being the in-game for-purchase currency) that led to a website where you could download an app that promised to "hack" the game and provide you with a thousand plat a pop. The app itself was touted on a file processing service like mentioned in the question and certified virus free... (cont'd) Commented May 19, 2014 at 13:27
  • @blunders ... and the instructions were to launch it, provide it with your in-game username and password, and it would handle everything else. Just because something doesn't contain a virus doesn't mean it's safe to execute. Commented May 19, 2014 at 13:28
  • @Shadur: I see. In my opinion, someone that would knowingly give away their access credentials in the way you've described likely has larger security issues than any automated security service would ever be able to account for; point being that it might be possible to account for that pattern, but the pattern is so fundamental of a concept, that it is not worth automating a solution for, and the the real issue is that the user lacks a basic understanding of security; or at least that's my opinion.
    – blunders
    Commented May 19, 2014 at 14:11

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .