If I "print to PDF" a website that has a malware will the pdf be infected?

Question

If I "print to PDF" a website page, but unknowing that has a malware or virus or some type will the pdf be infected?

Answer 1

It depends on how exactly the exploit on the website works. It is in fact not unconceivable that there might be an exploit which only works when the website is printed out, because it targets a vulnerability in the browser's print system.

However, even that is very unlikely to result in an infective PDF. A "print to PDF" functionality is usually implemented as a virtual printer driver. That means the web browser generates a printout, forwards it to the operating system's print system which then calls the driver which then takes that print output and turns it into a PDF.

Most web-based exploits use javascript or browser plugins like Flash or Java. Such active content can not be represented in print and not in a PDF either (PDF has some JavaScript support, but that uses a completely different API than javascript in a web browser, so most exploits won't be transferable). So most features which offer attack surfaces simply can't survive the conversion to a printout.

But keep in mind that there are known vulnerabilities in some versions of Adobe PDF reader (and other PDF readers) which can be exploited by especially crafted PDF files. This applies in situations where the PDF is generated by the website itself and not through the browser's print system. When an untrustworthy website offers some "download this as PDF" functionality, be careful about opening it.

Answer 2

No. "Printing to PDF" essentially captures an image of the website and none of the code contained within it. That said, before visiting a website like that you should likely make sure that your browser isn't vulnerable to whatever malware it's distributing.

In addition, even if the code did transfer to the PDF (which it doesn't), the attack vector is likely a vulnerable browser and not a PDF reader. Now if you downloaded an infected PDF that was created to exploit a PDF reader vulnerability (of which there are plenty) then you would have an issue, but not "Printing to PDF" a web page.

Answer 3

IMHO, the problem will not be in the generated PDF (even if there have been PDF exploits), but in the way you generate it. If you use a damned old good text only browser like lynx with no javascript support to download html and alii (gif, jpeg, css), this part is likely to be secure. If you use a normal browser with javascript enabled, the simple fact of browsing the page could allow the attacker to exploit a vulnerability on the browser.

And the second sensitive phase will be the conversion of the page into pdf. Because it will require some rather complex piece of software to interpret the HTML page, and the more complex it is, the more risk of implementation flaws are around. You will probably use a rendering engine for that (directly or not) meaning that the operation could trigger any exploit targeting the engine.

TL/DR: the generated PDF is unlikely to be compromised by a virus, but its generation could have triggered malwares.

Answer 4

It isn't possible to answer the question definitively because there are too many variables to know for sure but the answer is most likely not but it is theoretically possible.

PDF is actually a vastly more complicated file format that most people realize. It can be literally anything from a giant image of a scanned page to a mixed page with text and images and formatting to a 3D model from Autocad to a dynamic form capable of adding additional lines as needed to a scripting environment with interactive multi-media embedded in it or a encrypted digitally signed document*. Obviously that leads to a lot of complexity in the files and acrobat has been a target for exploits because of that.

I'd expect that a print to PDF would end up as a formatted page with a mix of text and images but it is possible for it to capture and embed multimedia content, dynamic content like java script and other things. It certainly is at least theoretically possible that an exploit could be created that would survive through being printed to PDF or even only show up when the page was printed to PDF. It is also quite likely that it could only apply to specific version(s) of a specific PDF viewer.

The thing I'd be more worried about would be my system getting infected by the Malware/Virus when viewing the page to be able to print it to the PDF in the first place.

*Not all features are supported in different versions of acrobat(standard vs pro vs 3d vs form designer) and may not be supported in the current acrobat version.

https://www.adobe.com/support/downloads/product.jsp?product=112&platform=Windows https://helpx.adobe.com/acrobat/using/adding-multimedia-pdfs.html