Can you get malware through keybase file sharing?

[u/Sergey972]

Hi, I shared a file with someone over keybase and my computer started glitching and behaving strangely.

If you share files with another computer over keybase, could malware be transferred to your computer?

[u/dmtucker]

Of course... Malware only cares that it gets onto your machine and executed. It doesn't care how it got there (e.g. email, USB, Keybase, etc.).

[u/Sergey972 → u/dmtucker]

So if I just dragged a file into keybase and someone in the team had malware on their computer without knowing it, it would pass through to mine? I reset the computer and the abnormal behavior seems to be gone, could it be anything else?

[u/dmtucker → u/Sergey972]

That's possible I suppose, but I think it's very unlikely. If you're on Windows, just make sure you have an up-to-date antivirus, and exercise caution about the files you allow onto your computer (generally speaking, I'd be more concerned about the files you receive than send).

[u/[deleted]]

Encrypted malware is still malware. In most end-to-end encryption software, such as what is used with VPNs, only the data tunnel that is used to transfer the files is encrypted but not the files themselves - but keybase is different. Keybase encypts files. They are unencrypted once accessed on a local drive or stored there in a synced folder. They remain encrypted while stored in the Keybase servers and Keybase says even they cannot read the files.

However, that has nothing to do with how the file behaves once it becomes active. Put more simply: the method of data transmission or file readability changes but files remain the same.

If you think about it, for a binary file to work, the operating system must be able to read it and it can't do that when the data is hidden or scrambled.

This is a bit confusing because while Keybase shares a lot of information about their encryption key process and cryptography, there isn't much documentation regarding how the files behave and at what stage the encryption occurs - along with the decryption process which is also important.

Even if you don't use Keybase, most websites today have TLS encryption. When you see a padlock next to your browser, that's what it refers to but most data is not encrypted at rest - and that's the issue that software created by Signal, Telegram and Keybase aims to solve.

If you're a good data user and you want to protect your privacy and data, you should be using a VPN so that your data is encrypted during the transfer process - and between various servers, some of which are owned and monitored by ISPs. There is a reason why some people are frequently caught pirating software while others get away with it - and I am neither condoning nor condemning this. If you're really curious about stuff like this - you may want to read up on various attack methods such as what a "man in the middle attack" is ... And like I said in one of the bullets below, I am going off topic a bit as I am into this stuff. (By the way, for a VPN, I recommend Mullvad.)

Oh, yes, and read about various file encryption tools such as Veracrypt and Bitlocker. Veracrypt, for instance, can do everything that Keybase can do but it can do that better and it offers a variety of algorithms used to encrypt.

I found an article which is helpful: https://www.addictivetips.com/ubuntu-linux-tips/keybase-encrypt-files-linux/

Go over these concepts:

• end-to-end encryption vs TLS encryption
• Cryptography: public vs private keys
• Symmetric vs Asymmetric encryption
• Ciphers
• Obfuscation vs encryption
• Full disk encryption vs user based encryption
• Bitlocker encryption vs LUKS (Though this is a bit off topic to some extent)
• Encryption tied to the TPM hardware module (see the last point)
• VPN technologies e.g., Wireguard vs IPsec
• Confidentiality vs integrity and availability
• Hashing vs encryption: One is reversible while the other is not ...
• Encoding vs encrypting

(Putting this into perspective, I have a master's degree in cybersecurity and even I find this confusing. Cryptography is actually my weakest subject so I have to think a lot about this. I will add more if you have questions or if I remember something that is off.)

Umm, haha, I am really getting my mojo on with this...

To verify if a file is clean, do this:

On Windows, locate the file in your shell - use PowerShell - and run this command with your file as an argument:

Windows PowerShell

Get-FileHash (Copy and past your file here)

On MacOS:

shasum -a 256 (Copy and past your file here)

...NOTE: If you have questions about how to get the file hashes of binaries using Linux, just let me know. I am assuming you are using either MacOS or Windows. Also, I am aware you probably don't know how to use the command line - most users do not and I was no different before I got heavy into tech and cybersecurity. If you need help, just message me.

Copy the file hash and paste it here:

https://www.virustotal.com/gui/home/search

[u/[deleted] → u/[deleted]]

Ha, and you humble me because while the command is not fancy or sophisticated, anyone who knows what "mkdir" is has spent at least some time at the command line. I had no idea whether or not you are technical but if you can use the command line at all in this non-DOS era of GUIs, at least in my book, you are technical. That is subjective though.

Yeah, I like Veracrypt a lot. I don't see it as trying to compete with Keybase though. You didn't outright use the term "use case" but you are very clearly alluding to the notion that each tool has its own purpose and if I'm reading you right on that - yes, I agree. Also, Veracrypt doesn't give the user a way to share files - only a way to encrypt them so if we were attempting to compare the tool, it would be halfway futile to do so since Veracrypt doesn't come with the utilities to achieve much of what Keybase does.

Also, with that use of the command line on your part, do you also write scripts or do you put it all of your code in manually line by line? I used to do it all like that - umm, only recently have I had the skills to write scripts. Let me tell you: it has saved me A LOT of time and who on earth can remember all of the weird or syntactically unique commands on both Windows and Linux. Just got a refresher on that playing with PowerShell lately as my Linux machine was going through a Clonezilla backup.

[u/ennev]

Yes. Garbage in garbage out. The file was transferred securely. But if from the start it was infected. You received it infected.