3

I was just given a postscript file containing what I was lead to believe was a document pertaining to some work I was being asked to consult on. Although it didn't seem to contain anything that resembled a document at all.

The guy who gave it to me seemed pretty keen for me to run the file in internet explorer. When I did explorer immediately opened and closed, but did not crash.

Is it possible that a postscript file can contain a malware of some kind?

1

PostScript is a Turing-complete language, so theoretically, yes, they could be malicious. However, a PostScript viewer wouldn't allow it to affect your files, so it would spend some of your cpu time.

On the other hand, you could put a .ps filename to any file, so requesting the file to be opened with Internet Explorer (which is not a PostScript viewer¹) could actually intend that Internet Explorer mime-sniffs that it is something else (a MHTML page, perhaps?) and runs on something else.

¹ If it is really PostScript what is being fed to Internet Explorer, the most sensible action I would expect would be an Adobe Acrobat Plugin to be invoked (although I don't remember it being able to handle .ps, you needed a different program for those). Could it be targetting something in such plugin?

  • Actually, any program may be infected with virus using customized input (on a Neumann style computer). If the data processing program contains bugs (and most code does) the attacker can use buffer overflow or other methods to execute the payload. – goteguru Jan 7 '18 at 0:26
  • @goteguru If the program opening it is vulnerable to a buffer overflow which leads to code execution, yes, it could be exploited. But I wouldn't name that as "any program may be infected with virus using customized input", as you have a quite hard precondition. Try crafting such vulnerable input for cat! :) – Ángel Jan 7 '18 at 0:31
  • Of course it would be challenging to exploit cat. However it's good to know it's theoretically possible to infect a computer with any data file (or data stream) let it be a png, mp3 or even xml, hence the comment. The point is, the format doesn't need to be something "executable". The precondition is not very strong, most complex program contains multitude of bugs, otherwise we wouldn't have a 22MB zipped CVE list. (BTW, zippers were reportedly exploited. :) – goteguru Jan 7 '18 at 0:42
1

I believe that you did no want to ask if a Postscript file can contain a virus but if Postscript can be used as attack vector. There are actually several examples where the complexity and power of Postscript could be used for malicious purposes:

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.