Is fb2 & epub files can be malicious like pdf? If yes, so how I can detect it manually ?
Malicious RTF, doc, docx, xls, ppt files can be detected via OLETOOLS. Malicious PDF files via peepdf, pdfid & others.
Add a comment
|
1 Answer
What is EPUB?
EPUB is an e-book file format with the extension .epub that can be downloaded and read on devices like smartphones, tablets, computers, or e-readers.
Can EPUB file contain malicious code?
Yes it can. (You can read this - https://www.baldurbjarnason.com/notes/epub-javascript-security/)
Here is another example of how epub had security flaw in past: XML External Entities
Are epub files often used by malware authors?
No. Compared to PDF and others formats epub is rarely used by attackers.
If you want to detect suspicious content (i.e. JavaScript) manually you can start with any hex editor and then you can write your own yara rules if it's needed. Of course if JavaScript is present that doesn't mean it has to be malicious but it can be a subject of further investigating.
Search in header of file for:
6D 69 6D 65 74 79 70 65 61 70 70 6C 69 63 61 74 69 6F 6E 2F 65 70 75 62
mimetypeapplication/epub
or:
74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74
text/javascript
More about epub/epub2 and epub3 go here - http://epubzone.org/news/epub-3-and-interactivity
-
3This assumes that the only exploit possible using epub is done with Javascript. But this is not the case. Also, the shown signatures might also match non-malicious epub. I suggest to change the answer to include that this is only one possible attack and also that the given signatures might result in false positives. Dec 28, 2017 at 5:50