0

I have PDF, Word and MP4 files on my site and I want to protect them from illegal downloading even if my site hacked. I want to put executable code in the files, so if someone downloads and opens them, the code is run to check if the file location is not the server or a specific location that I define. If not, the file is destroyed.

How can I put executable code in PDF, Word and MP4 files?

Improve this question
1
  • 7
    What you want is basically arbitrary, unprompted and unstoppable code execution by just opening the file for common file types. If this would be possible it would be a serious security problem - just imagine the possibilities for misuse of such a feature. But fortunately this is usually not possible (although bugs in reading application sometimes exist but get fixed).
    – Steffen Ullrich
    Jan 23, 2021 at 15:43

2 Answers 2

Reset to default
8

The field that you're nibbling at is called Digital Rights Management (DRM), and it's a big field. Protecting your documents and music, for example, fall under Content Restrictions.

There are significant shortcomings to applying DRM, some of which are:

  • It may make it harder for legitimate readers to access your content
  • It may break or end-of-life and leave your content unreadable
  • It may be possible for attackers to bypass DRM and access your content

As an example, if you Google "mp4 drm" almost all the top hits have to do with bypassing the protections, not with enforcing them.

In short, it's a hard problem with many bad solutions and a smaller number of usable ones. For these reasons, and because of the ethical implications of restricting content owner's rights, some people have rebranded DRM as "Digital Restrictions Management."

In summary:

  1. What you want is hard to do. It's not as simple as "putting executable code in mp4 and pd4 file"
  2. Solutions exist, but may be limited in usability
Improve this answer
1

You face many problems, which others have given an idea about.

Consider this problem. Why in Gods name would your legitimate users want to download any document that they know in advance contains code that will execute, and could delete files on their computer if it runs.

"Please trust me that I didn't make a mistake with my code, that I've considered every possibility at the clients and and it will never get it wrong. It will always get it 100% right. My coding is flawless. It will always know if the machine its on, is valid, however your systems are configured, whatever platforms and IPs you use, however they might vary dynamically. Nobody has ever, or could ever, hack my website or file store, or modify my code in a subtle way that causes mischief. It will never open a vulnerability for denial of service or damage if exploited. And you can trust totally that I never added advert tracking or anything negative, and never would."

Would I ever use your service? Would you get positive reviews? One answer: I wouldn't touch your downloads if you were the last service on the planet and the only thing between me and a severe problem.

Let's now add to that, most systems wouldn't allow your documents to run freely, anyway, exactly because of the scope for arbitrary damage.

Improve this answer
1
  • Plus on one very commonly used system even you allowed execution it is impossible for code running from a file to delete or otherwise 'destroy' that file
    – dave_thompson_085
    Jan 24, 2021 at 2:27

Not the answer you're looking for? Browse other questions tagged or ask your own question.