2

There's a file processing service that looks for some know attacks and sometimes returns messages like:

Probably harmless! There are strong indicators suggesting that this file is safe to use.

Are there heuristics that model the likelihood that a file is harmless, and if so, what is a simple example of such a heuristic, and what is the best way to learn more about the topic in general?

  • 1
    Sample heuristic: .TXT file containing only ASCII with a proper byte order mark. – goodguys_activate May 18 '14 at 20:19
  • +1 Right, that's the only thing I was able to think of too. – blunders May 18 '14 at 21:19
2

Likely heuristics are:

  • File is a valid file of a known type (eg. a JPEG that falls within a strict reading of the JPEG spec).
  • File does not contain any extraneous data (eg. JPEG permits unformatted data after the image. A safe file would not have any.)
  • File does not contain any known exploits for the format.

Other possible heuristics:

  • File does not use unusual features of the format (eg. a JPEG that uses unusual application-specific markers would be considered suspicious).
  • File does not appear to embed data of a different type (eg. a JPEG with something that looks like HTML in the comment field could be an attack on the Internet Explorer type-sniffing mechanism, though this is prone to false positives).

For learning more about this, I'd recommend reading up on the specs on a few file formats, and looking for exploits involving those formats.

  • You forgot 3. This 'file processing service' is actually a scam to reassure gullible users into installing 'virus-free' malware. – Shadur May 19 '14 at 6:49
  • @Shadur: Unclear what you mean by "[it] is actually a scam to reassure gullible users into installing virus-free malware." What do you mean? – blunders May 19 '14 at 11:43
  • @blunders Story time! I occasionally play an MMO named Warframe. Good fun, has a number of microtransacty things, lots of depth for a third person space ninja shooter. Couple weeks ago I got followed on Twitter by an obvious bot that advertised 'free platinum' (plat being the in-game for-purchase currency) that led to a website where you could download an app that promised to "hack" the game and provide you with a thousand plat a pop. The app itself was touted on a file processing service like mentioned in the question and certified virus free... (cont'd) – Shadur May 19 '14 at 13:27
  • @blunders ... and the instructions were to launch it, provide it with your in-game username and password, and it would handle everything else. Just because something doesn't contain a virus doesn't mean it's safe to execute. – Shadur May 19 '14 at 13:28
  • @Shadur: I see. In my opinion, someone that would knowingly give away their access credentials in the way you've described likely has larger security issues than any automated security service would ever be able to account for; point being that it might be possible to account for that pattern, but the pattern is so fundamental of a concept, that it is not worth automating a solution for, and the the real issue is that the user lacks a basic understanding of security; or at least that's my opinion. – blunders May 19 '14 at 14:11

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.