Creating a lightweight malware Scanner
Dear Cybersecurity experts,
I worked at a company where a lot of people would come by with their personal USB drives and use them to load documents onto computers inside the corporate network. These computers where outside of the internet and had no antivirus, meaning that if a virus would be loaded onto it using an USB it could damage the machine easily. Nobody ever checked the comtent of the usb drives before connecting them.

To prevent this, I came up with the simple solution of creating an application for the Raspberry Pi. The Raspberry Pi had a touchscreen, so when the user brought his usb drive, he would connect it to the raspberry pi, select it on the touchscreen and let it verify from the app. After it was confirmed from the application that the usb was clean, the user was allowed to connect it to the server. Even if a virus happened to infect the Raspberry Pi (very unlikely), it was easier to replace than a computer.

Since the Raspberry Pi 3 I used for the project didn't have that much resources to work with, the virus scanner I created was very simple and only used MD5 hashes to check for viruses. It compared each hashed file with a database and that's it. On one hand it's a very fast and lightweight approach, on the other hand it's not very secure.

So, since I'm not an Security expert myself, I wanted to ask you if you know any other systems I might use to check a file without using up too much resources. Sandboxing a file for example is probably not possible using just about 1GB Ram.

If you want to check it out, my project is open-source: Raspirus

I used the signatures in MD5 format from Virusshare for my database.
🗣Benben377

You could possibly try some sort of YARA implementation.

YARA:

https://virustotal.github.io/yara/

more resources and rule sets:

https://github.com/InQuest/awesome-yara
👤_hudsn


🎖@malwr