Scanning of encrypted zip files
There is disclosed in one example a computing apparatus, including: a hardware platform including a processor and a memory; and one or more mediums including instructions to instruct the processor to provide a security scanner to: determine that an object to be inspected is an archive including a plurality of bundled files; determine that the archive is encrypted; identify unencrypted data within the encrypted archive that can be made visible to an end user after a failed decryption operation; scan the unencrypted data for a pattern that matches password data; and attempt to decrypt the archive according to the password data.
1. A computing apparatus, comprising:
a hardware platform comprising a processor and a memory; and
one or more mediums including instructions to instruct the processor to:
determine that an object to be inspected is a zip archive comprising a plurality of bundled files;
determine that the zip archive is encrypted;
identify unencrypted local headers within the encrypted zip archive;
use regular expressions to scan the unencrypted local headers for a pattern that provides a password hint;
infer a decryption password from the password hint; and
attempt to decrypt the zip archive according to the inferred decryption password.
2. The computing apparatus of claim 1 , wherein the instructions are further to determine that the attempt to decrypt was successful, extract the bundled files, and perform a security scan on the bundled files.
3. The computing apparatus of claim 1 , wherein the instructions are further to provide the password hint to a human user.
4. The computing apparatus of claim 1 , wherein the instructions are further to determine that the attempt to decrypt was unsuccessful, and based on the determination, flag the zip archive as suspicious.
5. The computing apparatus of claim 4 , wherein the instructions are further to request end-user confirmation for the suspicious zip archive.
6. The computing apparatus of claim 4 , wherein the instructions are further to request enterprise security administrator input for the suspicious zip archive.
7. One or more tangible, non-transitory computer-readable mediums having stored thereon executable instructions to instruct a processor to:
receive an object for inspection;
determine that the object is a compressed or uncompressed zip archive file comprising a plurality of embedded files;
determine that the zip archive file is password protected;
locate unencrypted local headers within the zip archive file;
use regular expressions to scan the unencrypted local headers for a potential password hint;
infer a decryption password from the password hint; and
attempt to access the zip archive file according to the inferred decryption password.
8. The one or more tangible, non-transitory computer-readable mediums of claim 7 , wherein the instructions are further to determine that the attempt to access was successful, extract the embedded files, and perform a security scan on the embedded files.
9. The one or more tangible, non-transitory computer-readable mediums of claim 7 , wherein the instructions are further to provide the password hint to a human user.
10. The one or more tangible, non-transitory computer-readable mediums of claim 7 , wherein the instructions are further to determine that the attempt to access was unsuccessful, and based on the determination, flag the zip archive as suspicious.
11. The one or more tangible, non-transitory computer-readable mediums of claim 10 , wherein the instructions are further to request end-user confirmation for the suspicious zip archive.
12. The one or more tangible, non-transitory computer-readable mediums of claim 10 , wherein the instructions are further to request enterprise security administrator input for the suspicious zip archive.
13. A method of performing a security scan for a computing device or network, comprising:
receiving an object for inspection;
determining that the object is a compressed or uncompressed zip archive file comprising a file bundle;
determining that the zip archive file is encrypted by a password;
locating plain-text local headers within the zip archive file;
using regular expressions to scan the plain-text local headers for a password or password hint;
inferring a decryption password from the password hint; and
attempting to access the zip archive file according to the inferred decryption password.
14. The method of claim 13 , further comprising determining that the attempt to access was successful, extracting the plain-text local headers, and performing a security scan on the plain-text local headers.
15. The method of claim 13 , further comprising providing the password hint to a human user.
16. The method of claim 13 , further comprising determining that the attempt to access was unsuccessful, and based on the determination, flagging the zip archive as suspicious.
17. The method of claim 16 , further comprising requesting end-user confirmation for the suspicious zip archive.
18. The method of claim 16 , further comprising requesting enterprise security administrator input for the suspicious zip archive.