3

I'm going to be running an online business which will involve reviewing PDFs submitted by unknown users . How can I ensure my safety when opening PDFs.

Edit:I already have antivirus software

note: I have considered using a VM however I would like to know if there are any other practical methods

Improve this question
6
  • Some programs do a “sandbox” - but is one available for pdf??? – Solar Mike Mar 17 '18 at 23:01
  • 1
    Avoid Adobe. Use an alternative PDF Reader. Preferrably one that doesn't have support for scripting e.g. sumatra pdf reader. But run it inside a virtual machine anyway. There are also sites that can convert a pdf to html for you. www.pdftohtml.net – SpiderPig Mar 17 '18 at 23:40
  • 2
    There are also online pdf readers e.g. pdfpro.co – SpiderPig Mar 17 '18 at 23:46
  • From this post on security.stackexchange.com: security.stackexchange.com/questions/18878/… Using sandboxie+VM works as a rather simple and lightweight option – linuxdev2013 Mar 17 '18 at 23:49
  • For those who say "Avoid Adobe," is should be noted that the latest versions of Acrobat have built-in capabilities to mitigate security issues. If you open a PDF file from an external source, by default Acrobat will open it in Protected View with the following message: Protected View: This file originated from a potentially unsafe location, and most features have been disabled to avoid potential security risks. You can still view the document and click the Enable All Features button as necessary. – Run5k Mar 18 '18 at 2:12
0

I'd use Google Drive to view the PDF's, especially just the Preview should be sufficient for viewing only, and let Google check and update for viruses & safety (using an up-to-date browser).

enter image description here

It also has "apps" for opening PDF's like Lumen PDF and DocHub among others, for editing, etc. (Google Docs itself actually did a terrible job of opening a PDF for me, no images, basically copied only the plain unformatted text into a word processor.)

Then you don't have to worry at all about possibly infecting your local machine, and don't even have to download the files.

And, it's always nice to let Google handle the online backups directly too. Depending how "online" your "online business" is you might never have to keep a single file on your own device, and could have the whole business in your pocket on any device.

If considering a VM, they usually automatically install "convenient" features to use the VM easier, like drag files in/out and share files/clipboard, but AFAIK it's not a secret that the OS is running in a virtual machine.

Several live linux's specifically check to see if they're in a VM and have "utilities meant to be run inside the virtual machine... they provide closer integration and allow to share data through shared folders between the host system and the virtual machine." So I'm actually surprised Virtual machine escape isn't more wide-spread (related to Hyperjacking too, fyi).

So it looks like it would take more than just opening up VirtualBox with a linux ISO to try using a "hardened" system (but the read-only nature of a live ISO is good, not to mention general immunity to windows-specific threats).

Improve this answer
0

Using a VM is a little overkill. AV should be scanning it on receiving anyway. For extra peace of mind; Sandboxing would be the answer.

Using something like Comodo (free) virtual desktop or having it sandbox the PDF readers executable on execution is easiest I think.

I've run Comodo alongside other AV software fine, just disable Comodos AV. Mostly used for it's firewall features so it's extra protection.

As a side note .. Consider how all these PDFs would be created? If it's from your own service or customers/clients then there shouldn't be a problem if they want your services. (less likely but I know the problems)

  • update frequently.

PS: I think Google Drive will allow you to view PDF without "executing" anything locally, so see about storing them there and I'm sure it's virus checked also.

Improve this answer
1
  • 2
    Using a VM is a little overkill...until the first successful exploit breaks out and leverages an elevation of privilege vulnerability. Then it wouldn't be overkill. – I say Reinstate Monica Mar 18 '18 at 3:40

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.