What are people using to scan for malicious files before transferring the file out of a download qube?

[EverydayImbuffering]

Thanks ill keep that in mind, not sure what I can do about cloud services, still waiting on Joplin to sort out its future services

[ppc]

@EverydayImbuffering

still waiting on Joplin to sort out its future services

have you tried nextcloud

[EverydayImbuffering]

Im currently using Nextcloud

[ddevz]

@ppc

right click and select “Copy to VM” or “Move to VM”

@EverydayImbuffering

thats what I was doing before I used to qubes…

To make this more clear, if you are transferring from a disposable qube to another qube on your system, then you can load a file manager in the qube which right clicking will give you the options "Copy to VM” or “Move to VM”. A authorization window will pop up saying a file wants to be copied/moved to another qube, and it will ask you what qube to send it to.

The trick is getting to a file manager in a disposable qube because if you try to open a file manager from the “Q button” in the top left corner, it’ll launch a new seperate disposable qube which wont have your file in it. If you are running firefox in the disposable qube, you can get to a file manager by downloading something, then right clicking on the down arrow, and selecting “open containing folder”

[joe.blough]

@ddevz

The trick is getting to a file manager in a disposable qube because if you try to open a file manager from the “Q button” in the top left corner, it’ll launch a new seperate disposable qube which wont have your file in it. If you are running firefox in the disposable qube, you can get to a file manager by downloading something, then right clicking on the down arrow, and selecting “open containing folder”

I also download something in forefox to get a file manager within the same dispxxxx qube. If you need to scan a usb drive, you have to send it to the dispxxxx qube. You can also use a fixed name disposable but I’m not sure this is as secure.

[fiftyfourthparallel]

This probably isn’t very helpful for Linux newbies, but using the CLI commands qvm-move and qvm-copy, followed by the file path, would get around your issue. It doesn’t require learning anything remotely advanced, and people should really know how to enter filepaths into the terminal.

[ddevz]

I agree. That’s how I personally do it. I just put the “right click download” method in instructions I’m giving to other people since more people are likely to understand those instructions correctly then if I wrote out the whole qvm-copy/qvm-move method (which since it’s a disposable, requires making them aware of the right hand “Q” menu in order to open a shell)

[ppc]

@fiftyfourthparallel can you spit this from post 17 (with a hope of you don’t messing thing up)

[fiftyfourthparallel]

I glanced over the thread and don’t feel we have enough of a digression to warrant a split, and the content isn’t helpful enough to set up a new thread for people to find.

However, I can also see the case for splitting it, so I’ll leave it to other mods/leaders to decide.

[ppc]

It about copying file to other qubes, not scanning file

@fiftyfourthparallel

and the content isn’t helpful enough to set up a new thread for people to find.

oh, i see

[newbie]

@qubes-kernel-5.8

For PDFs you can always convert them to a Qubes’ Trusted PDF (bitmap form). There are other tools which can check PDFs for javascript, and it wouldn’t be too difficult to write a script to open said PDF in a DispVM, check it for javascript, and report back what it found. If you had a program to check other files for something you could just replace it for the PDF checkers in this script. Let me know if you want me to post the essentials of the script.

hi, do you mind to share the script ?
to convert PDF to Qubes’ trusted PDF (bitmap) and to check PDFs for javascript.

I see here also got similar reference:

Converting untrusted PDFs into trusted ones: The Qubes Way | The Invisible...

[ppc]

@newbie

hi, do you mind to share the script ?

it a build-in qubes tool that i don’t remember the name

[Scumbag]

I just open/edit all downloaded/incoming documents in DispVMs. In the case they would contain a rare Xen exploit and thus be able to compromise the machine, I don’t have any confidence that an antivirus would detect that anyway. Also, ClavmAV has a worse detection rate than the normal well known commercial antivirus softwares.

[ppc]

just recently found this

GitHub - rshipp/awesome-malware-analysis: Defund the Police.

GitHub - rshipp/awesome-malware-analysis: Defund the Police.

[ddevz]

After you edit a file, do you never send that file to anyone else?
Especially if that someone else considers emails from you as a trusted source.

Not expecting it to catch everything, nor relying on it catching everything, but I don’t see that as a reason to actively avoid doing it.

[arkenoi]

“Scanning” is a bad idea. Normalizing/sanitizing data is the proper way.

[ddevz]

Can you elaborate?

[arkenoi]

The idea of “antivirus”, “malware detection” etc is based on an illusion that you can enumerate “all bad code” or heuristically detect all code that could be “bad” (which leads us to computational problems that are proven unsolvable). Sanitizing data to a known safe format keeps us within the bounds of a predictable state machine.

[unman]

The idea of “antivirus”, “malware detection” etc is based on an illusion that you can enumerate “all bad code” or heuristically detect all code that could be “bad” (which leads us to computational problems that are proven unsolvable).

I don’t know any one in AV who believes this.

Sanitising data is well and good, but for many people who interact
with corporate or “ordinary” contacts, it’s not an option.
I work almost entirely in plain text - even so I have to interact
with contacts who use Office - whether MS or libre - and are part of an
ecosphere where that is the common currency. Or they use PDFs with
many Acrobat features.
In those cases, it makes sense to scan outgoing attachments with the
best tools available. I cant afford to do otherwise.
This is part of being a good neighbour.

I **never** presume to speak for the Qubes team. When I comment in the Forum or in the mailing lists I speak for myself.

[Scumbag]

@ddevz

After you edit a file, do you never send that file to anyone else?
Especially if that someone else considers emails from you as a trusted source.

Not expecting it to catch everything, nor relying on it catching everything, but I don’t see that as a reason to actively avoid doing it.

All people I send files to use Windows with an AV, so they already automatically have the files scanned.
Plus, if the file is created by me on Qubes, the chances of it being infected are way smaller because of Qubes compartmentalization.
I also don’t see it as actively avoiding doing it, since that is default on non-Windows systems. It would be actively doing it if I were to scan documents.

It is also not my responsibility that a receiver doesn’t scan files received from me, because he deems it not necessary as he considers me trusted. The responsibility for that choice is theirs. If you receive a file from someone you trust, do you choose to not scan or otherwise not take security precautions before you open it?