I was reading the warnings with Tor and was curious about this one inparticular:

Don't open documents downloaded through Tor while online

The Tor Browser will warn you before automatically opening documents that are handled by external applications. DO NOT IGNORE THIS WARNING. You should be very careful when downloading documents via Tor (especially DOC and PDF files) as these documents can contain Internet resources that will be downloaded outside of Tor by the application that opens them. This will reveal your non-Tor IP address.

In what way can opening a DOC or PDF reveal the IP address of a user who's in possession of it (without following a link)? I didn't know just opening a .docx file can communicate arbitrary information to an arbitrary server on the internet?


When started, Adobe Acrobat can initiate a "phone home" to check for an update; this might include an installation-specific ID that could be exploited by an intelligence agency, so your TOR session's address might be associated with your installation. Or the document may have a custom unique certificate with a CRL that identifies the reader when it's checked, or that certificate ID could be monitored at an OCSP server. Or there may be malicious code exploiting an unpatched bug in Word that communicates back to whoever is trying to trace the document.

DOC and PDF documents are likely being called out because they have historically had poor track records with respect to exploitable bugs.

It's possible to configure Acrobat Reader to not intentionally communicate, and to turn off macros and such in Word, but one careless setting and you may be completely exposing yourself. Not opening the documents while online simply avoids most of the potential vulnerabilities, and is very easy advice for people to follow.

| improve this answer | |

Not the answer you're looking for? Browse other questions tagged or ask your own question.