has to open media files from untrusted sources in sensitive environments as part of their daily workflow
+
fear that a zero-day exploit could be in one of those media files
+
cyber attack would have huge impact on the business
Ask HN: Who Has This Pain?
1–10 of 11 posts
Re: Ask HN: Who Has This Pain?
#2If the downside risks are big and probable enough, use a USB drive and open them on a computer with no internet connection.
Re: Ask HN: Who Has This Pain?
#3I never had that workflow but if I did I would wrap all media players with bubblewrap and that would be inside a highly restricted VM that could only access the domains in questions. The account used to do this on the VM would be single purpose with no sudo/doas permissions and detailed auditd with immutable configuration. No DNS, only /etc/hosts. Only outbound TCP port 443 permitted to the specific IP's in question. Everything else rejected and logged. No sensitive files on the hypervisor.
Re: Ask HN: Who Has This Pain?
#4[deleted]
Re: Ask HN: Who Has This Pain?
#5If the downside risks are big and probable enough, use a USB drive and open them on a computer with no internet connection.
imma do that!
Re: Ask HN: Who Has This Pain?
#6Where are those media files from? It's pretty unlikely to encounter an RCE in media files these days. but if you are an important enough target, one could be crafted for your device or software (i.e vlc)
Re: Ask HN: Who Has This Pain?
#7I never had that workflow but if I did I would wrap all media players with bubblewrap and that would be inside a highly restricted VM that could only access the domains in questions. The account used to do this on the VM would be single purpose with no sudo/doas permissions and detailed auditd with immutable configuration. No DNS, only /etc/hosts. Only outbound TCP port 443 permitted to the specific IP's in question.…
This is the way.^
Re: Ask HN: Who Has This Pain?
#8What is a 'sensitive environment' in this case?
If it's a sensitive environment like what I'm thinking, you probably have a security officer. What do they say should be the process?
Is the device the sensitive environment? Or is it the network?
Can you have a separate device/network in which to do this?
Re: Ask HN: Who Has This Pain?
#9[deleted]
Re: Ask HN: Who Has This Pain?
#10[flagged]