Solved

Can Viruses spread while transferring Binary data with Winsock

Posted on 2016-09-02
2
105 Views
Last Modified: 2016-09-02
Can Viruses spread while transferring Binary data via (TClientSocket/TServersocket) Winsock buffer stream across a network ?

I have a backup server application running on a machine that is not shared and is not connected to the internet.
My applications Client modules running on all machines connect via TClientSocket/TServersocket pair to the backup Server machine and transfer relevant data files. I am using Delphi on Windows.

Assuming that the data files are not yet infected but Client machine EXE's are infected with Ransomware Virus will the data be safe on the unshared backup server machine ?
0
Comment
Question by:Allan_Fernandes
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
2 Comments
 
LVL 18

Accepted Solution

by:
LesterClayton earned 300 total points
ID: 41781462
Answer: No.  Applications written to use Windows Sockets won't arbitrarily start transmitting virusses even though the OS is infected.  Virusses can only be transmitted on application layer, and they propogate themselves, or rely on other software to propogate (for example, mail clients).  They don't work at lower layers, so applications you write can't spread the virus if if the client machine itself is infected.

You're more at risk if your clients are mapped with a network drive to the backup server, since the ransomware clients will attack any UNC paths the user has access to.  If you have no UNC shares, you're safe.
0
 
LVL 63

Assisted Solution

by:btan
btan earned 200 total points
ID: 41781529
Ransomware can "spread" by network like thru RDP and mapped/unmapped network shared drives from an infected machine. E.g. LowLevel04. The spreading may be possible if there are other malware other than ransomware - such as the carrier (such as exploit kit) that exploited the machine and bring in or drop the  Ransomware. The exploit may hijack winsock layer to tamper or inject "addition" into the connection in session. Not seem so far for the Ransomware family though by itself to do that.
http://www.scmagazineuk.com/ransomware-using-remote-desktop-to-spread-itself/article/448377/

So if the machine is really isolated then I will say it is not possible to further spread and it can be contained. Backup data should not be accessible on the same machine of network shares otherwise it will be encrypted or deleted.
0

Featured Post

Free Tool: SSL Checker

Scans your site and returns information about your SSL implementation and certificate. Helpful for debugging and validating your SSL configuration.

One of a set of tools we are providing to everyone as a way of saying thank you for being a part of the community.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Suggested Solutions

Title # Comments Views Activity
How to load 2 images in same column in Delphi 2 80
Firemonkey allowing RTL on android 6 76
Non admin needs to install programs 17 103
Firemonkey Tcameracomponent resultion 1 45
Recently, I read that Microsoft has analysed statistics for their security intelligence report. It revealed: still, the clear majority of windows users do their daily work as administrator. An administrative account is a burden, security-wise. My ar…
OfficeMate Freezes on login or does not load after login credentials are input.
Attackers love to prey on accounts that have privileges. Reducing privileged accounts and protecting privileged accounts therefore is paramount. Users, groups, and service accounts need to be protected to help protect the entire Active Directory …

734 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question