2

I recently received a PDF file that, when attached to a gmail message, causes a warning to be displayed as follows:

Encrypted attachment warning – Be careful with this attachment. This message contains 1 encrypted attachment that can't be scanned for malicious content. Avoid downloading it unless you know the sender and are confident that this email is legitimate.

However, I am able to open the file without getting prompted for a password. I followed the advice given in this security stack exchange question and used the pdfid.py program whereupon I got the below output:

$ pdfid.py ~/Downloads/filename.pdf
PDFiD 0.2.7 /home/username/Downloads/filename.pdf
PDF Header: %PDF-1.6
obj                  402  
endobj               402 
stream               401  
endstream            401
xref                   0
trailer                0
startxref              1
/Page                  0
/Encrypt               1
/ObjStm               15
/JS                    0
/JavaScript            0
/AA                    0
/OpenAction            1
/AcroForm              1
/JBIG2Decode           0
/RichMedia             0
/Launch                0
/EmbeddedFile          0
/XFA                   0
/Colors > 2^24         0

It would seem to me that since this file contains no JavaScript it is safe to open and handle. But I am puzzled by the encrypted message that Gmail displays. I guess it is related to the /Encrypt flag that's set on the above output.

Why is Gmail telling me that the file is encrypted even though I can open it without being prompted for a password and would that, on its own, be reason for concern?

  • 1
    Seems like a legitimate warning. If an attachment can't be scanned (e.g. if it is encrypted) then gmail can't be sure it is safe. What confuses me is how you were able to open it without a password - could be encrypted with a blank password, though you might be prompted anyway? – Pedro Jul 1 at 10:12
  • Only gmail knows... – Martin Schröder Jul 1 at 10:17
1

Of course Google will warn about encrypted content, especially if it is not encrypted by themselves, hence they cannot decrypt the file. The warning comes only because they are not able to see the file's contents, not because there is something wrong with it. At all times they will prefer having control of all the variables: holding your password, the encryption keys and so on.

Now, this doesn't add up:

However, I am able to open the file without getting prompted for a password.

What is expected for decryption is a key (not a password), but still, you need something. If you can see the contents without the key, it is not encrypted, maybe coded but not encrypted.

As always, you should use good sense to decide about this attachment:

  • where it came from?
  • do you know who the source of the file is?
  • did you asked for it?
| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.