1

I've heard of too many horror stories of people opening a seemingly innocent docx or pptx file that they've got from a business partner, only to find out that it had embedded malware inside. What should a security conscious person do if they receive a doc or a ppt file that they wish to see the contents of, but cannot guarantee the reliability of its source? Is there any recommended practice to handle this, besides 'don't do it'?

4
  • 1
    Open it with LibreOffice on Linux would be a good starting point.
    – ThoriumBR
    Jan 19, 2021 at 18:23
  • 1
    Disable macros and scan with anti-virus? Confirm the file with the sender? There are some very basic recommendations that have been around for years. Are you looking for something more than that?
    – schroeder
    Jan 19, 2021 at 19:03
  • Yes, just wondering is there an IT industry standard approach beyond the basics, since I imagine it's common problem.
    – Mahn
    Jan 19, 2021 at 19:37
  • You switch back and forth between speaking about doc/ppt and docx/pptx. That's a huge difference Jan 19, 2021 at 20:29

1 Answer 1

0

There are a number of ways that you can deal with files that can be malicious depending on the amount of time and expertise that you want to invest. Here are a few ideas and suggestions:

  1. Anti-malware product

This is essentially the bare minimum. Have some form of anti-malware product on your system where you can force a scan of the file and see what it says. This is typically great for known malware families and will give you a good indication

  1. Best practice based on how the file was received

Did you expect to receive the document? Who has it come from? Are you being asked to enable active content when the file opens? Is it in a password-protected archive with the password in the body of the e-mail?

These are all common questions we can ask ourselves when receiving files (especially via e-mail). In many cases, a malicious attachment will be an unexpected / generic e-mail from someone which you weren't expecting.

  1. Use a Sandbox

Sandboxes allow you to see the behaviour of the file without opening it in your environment. These typically do a deeper scan of the file than you will get with on box anti-malware products. There are a number of cloud sandboxes that you can try:

A word of caution here; beware of submitting private files to free-to-use services. If you are not paying for the service, your file will most likely be shared among the community. This is of course great for malware samples, but less so for confidential information.

  1. VirusTotal

Finally, VirusTotal gives a good representation of what the industry as a whole knows about files. You can also upload samples to get them scanned by multiple vendors at once. NOTE: The above caveat about privacy applies.

Here you have to make your own decision, do you believe a file is malicious if 1, 10, 20, 50 vendors mark it as malicious?

As you can probably tell there is no one size fits all answer to this question.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .