10

Just a general question of computer security - if I download a .pdf or .docx from an untrusted source, can it seriously harm my machine/give a malicious user access to my information? Or is it sandboxed somehow?

(Sorry if there's a different Stack Exchange I'm supposed to be posting this on.)

1
  • please add potentially to your question title before dangerous
    – Jader Dias
    Nov 22, 2010 at 23:39

5 Answers 5

18

PDF files have been increasingly dangerous recently. Turn off Javascript and/or use different viewers (another answer mentioned this, not sure why he was downmodded).
There actually are different ways that files can come after you.

  • Raw executable files. .exe, .scr, .com, .bat, etc... plain executables that people run on their computer. You'd never do this right? What about screensavers you download (yes, a .scr is just an .exe with a special command line to hook to the screen). Old viruses took advantage of Explorer hiding extensions. What you thought was hotgirl.jpg was really hotgirl.jpg.exe, Explorer would hide .exe since it's a 'known' extension and you'd just see hotgirl.jpg, click it, and owned.

  • Executable data - macros/javascript. MS Office Docs have a full macro language that has/had access to mail and the filesystem. Internet Explorer as well, plus access to ActiveX controls. Adobe Acrobat PDF has had a particular bad rep recently for Javascript holes. These are a bunch of all those Mozilla/IE errors you read about. Sometimes these are 'sandboxed', meaning they are given a place to play that in theory shouldn't hurt the rest of your computer, but only Chrome has a pretty solid sandbox.

  • Parsing error. Bugs in programs can lead to code execution. In a program, you think of executing code and incoming data as separate, but in reality they're mixed in a couple areas called the stack or the heap. If I'm a smart and evil programmer, I can pass you code in the data I give you and trick your program to run it. A lot of image exploits happen this way. PDF readers have had these as well. The more complex the document, the more likely it will have these errors (which is why PDF readers have a lot of exploits).

So, PDF files are both complex (so easy to have bugs in parsing code that can be used for malware) and have Javascript, which can be used for nefarious purposes as well. Same with MS Word files.

What's safe? Not much. Almost everything has had holes. Plain text files probably the safest, since few things 'parse' them in any way. But even a small amount of structure needs a parser, and parsers make bugs. XML is text, and that gets exploited. Docx is a zip file of XML, and that can be unsafe.

In short, it sucks. almost everything out there is dangerous. Keep yourself patched (many exploits are from bugs) get antivirus, don't use IE, use Chrome or Mozilla. Hmm, no real good answers.

As far as the sandbox goes, as someone else said, try google docs, its a parser on their machines that can get played with, not your machine. As far as I know, neither Word nor Reader have real sandboxing. Both allow you to turn off code (macros or Javascript) and you should do that, but that's not full sandboxing.

(very late) EDIT: RE: 'untrusted source'. All sources are to be untrusted. Email attachments haven't been trustable since the first Outlook viruses that were smart enough to send attachments to people in your contact list. If I can hack somewebserver, somewebserver goes from trusted to an untrustable source. Beware of all.

6

As these members have said, and i agree with, no file can fully be trusted from the internet no matter what file extension (.exe, .jpeg. .pdf ).

As long as you have a good scanning tool like Norton Antivirus 2011, or something similar it should be scanned when downloaded. If not do be sure to scan the file before opening.

2
  • there can be macros written within the .docx files as well. Nov 22, 2010 at 18:03
  • Don't need to have AV installed, just run it through virustotal.com. Nov 22, 2010 at 18:56
4

There have been PDF exploits in the past.

3

yes dangerous

docx has had some problems in parsing properly...from renaming html files to docx extension and letting word open to render a webpage (you can get it to try to authenticate to an attacker owned smb share that dumps hashes) to actual overflow vulnerabilities. pdf exploits are a lot more common, but no file format is "perfectly safe". trusted sources or additional sandboxing/file scrubbing in highly secure environments

1

I would suggest you to use alternative viewers for PDF like Foxit Reader(free version is ok.It also installs a toolbar,but if you want, you can uninstall it later) For .docx I would not know, I would just prefer the old extentions.. but maybe that's just me.

I would never install Norton Antivirus on my machine, maybe it's just luck, because it always crashed my pc.. I would prefer a free antivirus

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .