Untrusted Archives: When is Your System at Risk?

TL;DR

Your system is potentially compromised from the moment you start downloading an archive (like a .zip, .tar.gz, etc.) from an untrusted source. The risk isn’t just in opening the archive, but in the very act of receiving and processing the file. Here’s how to minimise that risk.

Understanding the Risks

Downloading archives from unknown sources carries several threats:

• Malicious Code Embedded Within: Archives can contain viruses, trojans, ransomware, or other malware disguised as legitimate files.
• Archive Bombs: These are designed to exhaust system resources during extraction, causing a denial-of-service (DoS) attack.
• Path Traversal Vulnerabilities: Cleverly crafted archives can extract files outside of the intended directory, potentially overwriting critical system files.
• Filename Exploits: Archive filenames themselves might exploit vulnerabilities in extraction tools.

Step-by-Step Guide to Safe Handling

1. Isolation is Key (Before Download):
• Use a Virtual Machine (VM): The best approach. A VM creates an isolated environment, so any compromise stays contained within the virtual system. Software like VirtualBox or VMware Workstation are good options.
• Dedicated System: If you don’t have VMs, use a separate, non-critical computer for downloading and inspecting untrusted archives.
2. Download with Caution:
• Verify the Source (If Possible): Is the source legitimate? Check their website directly, not just links in emails or messages.
• Use HTTPS: Ensure the download is over a secure connection (HTTPS). Look for the padlock icon in your browser’s address bar.
3. Initial Scan (Immediately After Download):
• Anti-Virus Scan: Run a full scan on the downloaded archive file before attempting to extract it. Make sure your anti-virus software is up-to-date.
• Online Virus Scanners: Use multiple online scanners (e.g., VirusTotal) for an extra layer of protection. Upload the archive and check the results from various engines.
4. Extraction Precautions:
• Use a Safe Extraction Tool: Avoid using built-in operating system tools (like Windows Explorer’s extraction feature) as they may have vulnerabilities. 7-Zip is a good, open-source option.
• Extract to a Temporary Directory: Never extract directly into your main file system. Create a dedicated temporary folder for this purpose. For example:

  mkdir /tmp/archive_extraction

• Monitor Resource Usage: During extraction, keep an eye on CPU and memory usage. Unusual spikes could indicate an archive bomb or malicious code running.
5. File Inspection (After Extraction):
• Examine File Types: Check the file extensions of extracted files. Be wary of executables (.exe, .bat, .sh) unless you explicitly expect them and trust their origin.
• Static Analysis Tools: Use tools like file (Linux/macOS) to identify file types regardless of extension:

  file filename.txt

• Sandboxing: If you must run an executable, do so in a sandbox environment (e.g., Firejail on Linux).
6. Network Monitoring:
• Check for Outbound Connections: Use tools like Wireshark or tcpdump to monitor network traffic during and after extraction. Look for unexpected connections to suspicious IP addresses or domains.
7. Post-Extraction Cleanup:
• Delete the Archive: Once you’re confident that the extracted files are safe, securely delete the original archive file.
• Empty Temporary Directory: Remove the temporary extraction directory and all its contents.

Important Considerations

• Zero Trust: Assume any archive from an untrusted source is potentially malicious, even if it passes initial scans.
• Regular Updates: Keep your operating system, anti-virus software, and extraction tools up to date with the latest security patches.
• cyber security Awareness Training: Educate yourself and others about the risks of downloading files from untrusted sources.