What are people using to scan for malicious files before transferring the file out of a download qube?

General Discussion
41

thank you, really complete list

42

Believe me, if a client received an infected file from me, they wouldn’t
stay a client for long.

I never presume to speak for the Qubes team.
When I comment in the Forum or in the mailing lists I speak for myself.
1 Like
43

note: both of there link are not same link

1 Like
44

note: both of there link are not same link

okay, same page, different part, thanks

45

Ah yes, if your recipients are clients the situation is different and you’ll have to take that into consideration of course :upside_down_face:

46

Even for friends, your reputation as a security wonk will take a real
hit if you are sending out malware. (Unless it’s some switch where you
convince them that they are only worried because they aren’t running
Qubes.)

47

Well, I rarely send files I got somewhere else anyway, 99% of the time I created them myself on Qubes.

48

Can you elaborate on your process for normalizing/sanitizing every file you download?

49

@arkenoi I love your idea of “sanitizing to a known safe format”, but as @unman pointed out, the ecosphere require us to remain in the same formats. Can you point us to tools/utils that sanitize a file and then return it to the same original file format?

50

qubes-app-linux-img-converter/README.md at master ¡ QubesOS/qubes-app-linux-img-converter ¡ GitHub
qubes-app-linux-pdf-converter/README.md at master ¡ QubesOS/qubes-app-linux-pdf-converter ¡ GitHub

1 Like
51

thanks @apparatus . Anything for handling the “beloved” MS formats (docx, xlsx, etc.) ?

1 Like
52

the best I can see would be to convert it to a text file in a disposable, or print it as a PDF and then convert the PDF into an image using the pdf converter above.

1 Like
53

I’m not familiar with any of them, but you can search for Content Disarm & Reconstruction tools:

4 Likes
54

sandboxing or a dvm in other words? Good point.

any anti-virus / malware scan (clamav, chrootkit, etc) I have done on linux always comes up with nothing. Does anyone regularly get detection? What are you doing to get known malware? All I get are zero days and perplexities.

might add that certain kinds of DNS filter malware. Domain over Https over Tor may not, but, then again, being a more trackable target may also be bad if your adversary is advanced and actively targeting you (any transfer of information is a potential vector).

55

@solene I found this site: DOCX Parser Online - Extract Text And Images From DOCX Document
I highly doubt anyone using Qubes (Qubers?) will upload their files to be parsed in a cloud service, but having such service implies that extracting the content is possible. creating a docx with a desired text should be possible as well.

56

Thanks @apparatus
DocBleach looks promising

1 Like
57

An antivirus thread?! What a throwback to decades past. :smiling_face_with_tear:

The thought of using an antivirus in Linux has literally never crossed my mind. The way I figure it, most consumer viruses target W*ndows sheeples, and most Linux viruses that aren’t 0-days either target enterprises or come straight from the package manager. Common sense and compartmentalization are best antivirus :ok_hand:

58
  1. You may send files to people that don’t use qubes
  2. Anti-virus software requirements can be found in some security standards now.

Check out unmans thread ending in:

59

See also: