I am trying to conceptualize a server where users can upload potentially dangerous malware samples to a server. They would not need to be stored in the file system per se but kept in memory long enough to be analyzed by other programs/libraries. (Similar to: VirusTotal)
I'm not opposed to incorporating other open source solutions/libraries, but my main concern is reducing risk to the overall system between when a user uploads the file to a web service and getting it to other programs for analysis.
- If the file is never saved, and remains only an input stream (java), would that be a strong mitigating factor?
- Do you know of any resources that are relevant/talk about sandboxing while still exposing some ports, in constant use by a program, for exchanging analysis information with another local server?
- Do you have any recommendations or warnings for accepting malware sample submissions? (If "don't try", please elaborate on the pitfalls)