Can an application that writes any data in a file be suspicious to an antivirus?

2

I am developing an application that, in order to work, needs to download data from the internet and store it in a .dat file.

The problem is that some of that data is generated by other users. If a user uploaded for instance the fingerprints or parts of a known virus, would antiviruses be alerted when they see my application writing that data into the file, even though it is treated as data only (never actually executed)?

In that case, is there a standard way of solving this issue? Would AES encryption with a constant password help?

Nathan Parker

Posted 2016-02-15T11:59:08.277

Reputation: 123

You wouldn't need AES just to hide strings from an antivirus program, anything it doesn't normally read would work (they scan most compression formats), no real encryption even required, just a way to reversibly change the data. I'd imagine something like ROT-13 may even be sufficient. You're probably not the first person to ask how to keep "virus samples" on your computer without all sorts of alarms going off, tried a web search? – Xen2050 – 2016-02-15T13:13:32.997

@Xen2050 Wouldn't ROT-13 make it too easy for an attacker to calculate the string that when ROT-13'ed turns out to be the virus sample? – Nathan Parker – 2016-02-15T15:23:11.297

There's no "attacker" is there? You're just avoiding antivirus scans from alarming. Of course, if your users are intentionally uploading viruses to your server (and you're not researching viruses) then maybe you should let the antivirus programs set off alarms – Xen2050 – 2016-02-15T16:28:36.387

I think you didn't understand the question, or I didn't explain myself correctly. The key here is that there is a shared file that can be modified by anyone in a peer to peer network, just the same that happens with the bitcoin blockchain. I heard that bitcoin had problems when a malicious user created a transaction with bytes of data that were recognized as virus by many antiviruses causing bitcoin to stop at that point of the blockchain. I would like to know whats the fastest algorithm that I could use to prevent that, and the best one I can think of is AES. – Nathan Parker – 2016-02-15T17:14:00.610

Answers

2

An antivirus may flag a file which matches the heuristics of a known virus. You can test this with an eicar test file, a string that isn't actually malicious but should trigger an antivirus to react to it.

By encrypting data before storing it, an antivirus would have no way to know the content of the file, so simply writing encrypted text shouldn't trigger an antivirus response, unless you are also doing other suspicious activity.

Jonno

Posted 2016-02-15T11:59:08.277

Reputation: 18 756

Asked: 2016-02-15T11:59:08.277

Viewed: 42 times

Active: 2016-02-15T17:18:03.897