25

Corporate security trainings keeps saying "download a file from the web or email attachment and open it and you might become infected". I know this used to be the case on old Windows machines in the 90s, but is it still the case on any computer? Obviously if you open a shell file or executable file or app that might be a problem, but at least on Macs, Apple has that warning popup.

Are they basically suggesting that there might be some exploitable holes in the software we use "regularly" (like excel or Apple numbers, or Apple preview for PDFs), and they can exploit those loopholes to install something somehow? The loophole would be unknown to the company providing the software but known to the attacker? That's the only way I can see them getting access to your computer, is there another way? I would assume in today's world, there is 0% chance of getting "infected" by opening a PDF or .xlsx or .doc file on a Mac, but is that not true?

As a bonus question, if it is still true today that opening a "normal" file might install malware, what is the recommended approach to avoiding this, assuming you want to be able to open these files (and assuming you've checked it's from reputable sources, etc.).

10
  • 50
    "I would assume in todays world, there is 0% chance of getting "infected" by opening a PDF" -- have you looked this up? Have you confirmed this assumption? Have you seen the multitude of emerging products being developed to combat this growing threat?
    – schroeder
    Oct 5, 2021 at 8:00
  • 33
    "Apple has that warning popup." -- and people like to dismiss pop-ups. There's even a name for it: "warning fatigue".
    – schroeder
    Oct 5, 2021 at 8:11
  • 18
    PDF is as a format notorious for being an attack vector into PCs
    – Hobbamok
    Oct 5, 2021 at 9:23
  • 1
    This related question might be useful: security.stackexchange.com/questions/97856/…
    – Murphy
    Oct 5, 2021 at 12:24
  • 12
    "The loophole would be unknown to the company providing the software but known to the attacker?" extremely common Oct 5, 2021 at 17:20

9 Answers 9

73

Simple Instructions Over "Correct" Instructions

You may be a security expert, or at least a very knowledgable person when it comes to computers, but the vast majority of people - even those, who work with computers on a daily basis - are not. I know entirely too many people, who think computers are basically a box full of plastic and magic.

Explaining to these people which file extensions are more likely to be dangerous and which ones are less likely to be dangerous will probably lead to a lot of confusion. I assure you that a significant amount of people, who work in an office, can't tell the difference between a PDF document and a Word document, so explaining what the risk of each is is not very productive.

As such, broad statements like "Don't open files from e-mail attachments unless they are from a trusted source" are useful still, even if they are not 100% technically correct.

Which Files Are Dangerous?

Basically, all of them. Always presume that a file is dangerous, even if you can't imagine how it could possibly. Here is a list of some common file types and how they could be dangerous:

  • PDF Files: PDF is a complex file format and as of the time of this writing, over 1500 expoits related to PDFs exist in the CVE database.
  • Office Documents: One of the most prominent attacks in Office documents is macros. The general idea is that you send someone an office document, claim that it contains some important information, then create the document in such a way that it only displays the supposed information if macros are enabled. For example, you can steal NTLM hashes like that.
  • Spreadsheets: Also related to Office applications, you can create a malicious spreadsheet, which executes OS commands when being opened. This attack is called CSV Injection.
  • ZIP Files: ZIP files can be quite dangerous. For one, they can cause Denial-of-Service attacks through something like a zip bomb or place arbitrary files on a machine through zip slipping.

While there are indeed measures to mitigate some of these risks, often times these include asking the user if they want to do something risky. 9 times out of 5, they will say yes. Not because they understand that the action they're about to take is risky, but because their computer asks them so often if they want to do something and they're used to playing the little game where they have to find the button that makes the computer do what they want to do.

How to Mitigate This Risk?

There is no perfect one-size-fits-all solution. If there was, we wouldn't have to worry about malware. It depends largely on the technical expertise of who you are talking to.

When talking to an expert, I would say "Trust your gut!". Your instinct is the most advanced part of the brain, optimized over millions of years through the most brutal optimization process in existence - you do well to use it.

If you have a bad feeling with a file, don't open it. And if you have to, do it in a VM on an airgapped machine, which you completely scrub afterwards.

When talking to the average user, I would repeat the same handful of security tips you have heard a million times. Don't open files from untrustworthy sources, have an up-to-date anti-virus, etc. etc. You've heard it a million times before.

19
  • 17
    @Alien ClamAV is one way, but don't see "Didn't find anything" as "Nothing is there"
    – user163495
    Oct 4, 2021 at 21:09
  • 4
    @Alien: Also, be aware that that's not a panacea. The problem with those formats is that they are highly complex and highly arcane. The exact same reasons that make it likely that libraries for processing them may have exploitable bugs also mean that libraries scanning them have a hard time fully understanding them … and may have exploitable bugs themselves. Remember that "scanning for malware" is essentially equivalent to "solving the Halting Problem". Oct 5, 2021 at 6:14
  • 3
    PDF is based on PostScript, which is a full-blown Turing-complete programming language. While PDF is somewhat more restrictive, it is still very complex. MS Office files essentially started out as barely more than memory dumps of the running program. They are so complex that even Microsoft doesn't fully understand how they work. The (not so) "new" XML-based "Open OfficeXML" file formats (.docx, .xlsx, .pptx, etc.) still try to cover all the functionality of the old formats, so they are also very complex: the spec is well over 7000 pages, and there are three mutually incompatible … Oct 5, 2021 at 6:22
  • 4
    I'd also add that there's an additional issue about "Which files are dangerous?" - the Right-to-Left Override Attack vector is something that would allow a larger set of even completely trustable file types to become untrustworthy. i.e. "The file is 'trustworthytexe.txt' is a text file, ergo it's trustworthy." Oct 5, 2021 at 7:40
  • 29
    @Nelson I think every statement you made is incorrect ...
    – schroeder
    Oct 5, 2021 at 16:37
13

Just downloading a file is unlikely to be dangerous, but making any use of a downloaded file can be. Even "unused" files are routinely used without your explicit knowledge. For example, downloaded files are routinely inspected by your antivirus software, and thumbnail images may be generated from downloaded images. These uses can't be guaranteed to be 100% safe.

There was a case where a widely deployed jpg library was the attack vector - all you had to do was view the image - even though viewing images is generally considered to be safe.

Imagine the embarrassment on Microsoft's behalf if malware successfully targeted using windows defender as an attack vector. AFAIK this has never happened, but it could.

2
10

Are they basically suggesting that there might be some exploitable holes in the software we use "regularly" (like excel or Apple numbers, or Apple preview for PDFs), and they can exploit those loopholes to install something somehow?

That's probably the concern. As an example, have you ever used WinRar or heard of it? Did you know that it had a code execution vulnerability for 19 years that was just discovered in 2019? After it was made public, it was being actively exploited. Is it possible that this flaw was exploited at some time between years 2000 and 2019? It's pretty hard to prove that it wasn't. Assume a user has WinRar installed and opens a file 'foo.text.ace' which looks like foo.txt to the user because the corporate policies don't allow showing file extensions (why, I'll never understand.)

The reality is that there are likely vulnerable applications installed on every Windows machine. The question is whether anyone knows about those vulnerabilities. It's really not a good plan to wait until someone exploits it by say, installing ransomware, to worry about it. Users need to know that this is a potential risk.

And yes, Excel is a widely-known to be a great way to deliver malware. If you can get the user to enable macros it's pretty much game over.

8

Untrustworthy files can always lead to an exploit if opened, no matter the OS or program

That is because all files must be parsed by some program to be useful. Programs are written by humans, who are making mistakes no human can even recognize as a mistake yet, whereas files are made by humans and machines as well. Therefore, you can never truly trust any program to be 100% secure. MacOS is only less targeted due to its lesser market share and Apple's sandbox. However, the walls are only so high and being less targeted only gives the illusion of security (a.k.a. security theater) through obscurity (Apple uses proprietary software).

File interpreting programs that have their own scripting language like Word or Excel allow the attacker social engineer the user into running their script, which can be the equivalent of executing a program an attacker just sent you. This is the most common method ransomware operators use to gain access to your systems, apart from just buying credentials off the dark web. This usually requires some action apart from opening the file.

Other file parsing programs that don't implement scripting can still be vulnerable to undiscovered flaws in their parsers that can lead to exploits that are more difficult to find and develop but require no user input apart from opening the file in the program.

Technically, any web browser is a file interpreting program with a scripting language. Any website you visit is essentially your computer downloading, rendering, and executing several files provided by a server that can't be trusted. This is why browsers like Chrome and Firefox have to update every 2 weeks with security patches. They are heavily targeted and are constantly handling untrusted files.

The only way to 100% guarantee an unknown file won't hurt you is to not allow any program to interpret any part of the file

1
  • 1
    @TobySpeight Makes sense. I've edited my answer accordingly. Thank you.
    – spicy.dll
    Oct 7, 2021 at 14:33
7

Yes, that's correct. The primary concerns are executable / script files, or malicious document files that exploit vulnerabilities in the applications that read them (e.g. Office, PDF reader, browser, etc.) in order to execute code on the victim's computer.

Being on Mac OS only really offers you security through obscurity - most people use Windows, so most malware is written for Windows. That said, remote code execution vulnerabilities are just as commonplace in Mac OS applications as they are Windows applications. Malware for Mac OS is quite common these days. There was a surge in banking trojans targeting Mac users around 5-10 years ago, and the trend has continued since - presumably attackers realised that if you're willing to drop a stack of money on a designer laptop, you've might have cash worth stealing, and since "Mac OS doesn't have malware!" is a common misconception the userbase tends to be less cautious.

The primary way to protect yourself is to install software patches and operating system updates in a timely fashion. If the vulnerability is patched, an attacker can't use it to break into your system. In addition, be wary of emails from people you don't know, especially if they have attachments. If in doubt, don't click. You should also be cautious about unexpected or unusual emails from people you do know, not only due to the potential for malware being spread via people's email contacts, but also because an attacker who compromises an email account or who registers one with a similar spelling might use it to trick you into sending them money or giving them sensitive information. A common trick is for an attacker to spoof an email from a CEO to someone in finance, asking them to buy gift cards for a client and email the codes back. It's always better to double-check directly with the person you think you're talking to (e.g. in person or over the phone) before actioning an odd request.

4

There are no-click exploits that show up from time to time and are exploited before the vendor has patched it, and no amount of user training will help there as clicking "Enable scripts/editing" is not required.

There is also an entirely separate class of vulnerability that allow for code execution if you just preview the file in explorer or your email client.

Both of these vulnerabilities are rare, second one even more so, but they do occur from time to time, especially with the introduction of new software.

2

Given the experience we have so far with software, it is rather uncommon that files aren't executable. Just because a file doesn't claim to be executable doesn't mean it isn't. Any piece of software complex enough will have bugs that cause it to execute code where no code execution was meant: it will, erroneously, interpret data files as code. This happens with such a regularity that it's not reasonable to treat "data as data". Data and code are the same thing, that's the rule. The exceptions are when things are done well enough to prevent it.

That's the reality of it.

4
  • That's not really true. The main way to do that is buffer overflows that are impossible in JVM or .NET or pretty much any modern programming language besides C/C++ unless you specifically turn off bounds checking, trading safety for speed.
    – prosfilaes
    Oct 8, 2021 at 5:22
  • @prosfilaes 1. Most people don't rewrite common libraries like libjpeg to run natively in CLR or JVM. 2. If one is writing a low-level file format handling library, could there be a likelihood that performance is at least a teeny-weeny-smidgen-of-a-bit important? 3. Buffer overflows aren't the only way to get some modicum of control over the victim's machine. Sometimes you don't even care about running disallowed code outright, but about leaking sand out of the sandbox using code that you can legitimately run at two privilege levels. One bit of such code may well be some JS in a PDF file :) Oct 8, 2021 at 18:06
  • Which seems both narrowing "any piece of software complex enough" to exclude a lot of real life systems and expanding "it will, erroneously, interpret data files as code", which is a lot narrower than "some modicum of control over the victim's machine." Mel, from "The Story of Mel", derided using assembly because performance was important and an assembler impaired the optimizations he could do by hand; the idea of using a HLL like C and imagining your code was efficient...
    – prosfilaes
    Oct 9, 2021 at 0:43
  • Concretely, The Computer Language Benchmarks Game's Spectral Norm benchmark show the C program as the fastest, with the runner-up Rust program taking 1.8 times as long. But it also shows the C program most people would write as taking 14 times as long, 7 times slower than the fastest Rust versions and slower than naive implementations in Ada, Go, Swift or Dart. Also, during this comment, I opened a PDF file instantaneously and then had to step through it slowly because the UI had no "whole words only" or "preserve search case" options. Optimization is often misspent.
    – prosfilaes
    Oct 9, 2021 at 0:57
1

Adding to the previous answers that mention the antivirus as an attack surface, while I'm not aware of it having ever happened, your file system is an attack surface too. And of course, the system calls used to deal with files.

In other word, saving the file on your disk could trigger something. File systems are usually very robust, but it is still possible. This article digs in a remote code exploitation vulnerability on NTFS (while not conclusively being able to exploit it).

On top of that, while unlikely again, simply the file name could trigger an attack if a software was processing it (think "PowerRename" from the MS power tools).

And finally, for the worst part, it is also not impossible that simply writing the data to your storage will trigger a vulnerability in the storage. This is a lot less likely, and would work on a much smaller range of hardware. You are unlikely to be the target of such an attack, they are extremely complicated. Here's an article dealing with dumping a disk firmware, opening the way to looking for vulnerabilities using the binary code... Note: I am myself unaware of such exploit (as in, an exploit triggered by writing data) in HDD/SSD firmwares. I'm aware of attacks on HDD firmwares, but not triggered that way.

3
  • "antivirus as an attack surface, while I'm not aware of it having ever happened" Well, then you should spend some time reading up on this whole range of attacks of which apparently you haven't yet had the joy to learn.
    – Nobody
    Oct 7, 2021 at 13:40
  • No, I meant I'm not aware of any successful attack on the FS (for instance, an attack on ntfs3g driver, Windows NTFS driver...). I however pasted a link to a vulnerability, reported by Microsoft, but the article concludes they couldn't exploit the vulnerability identified. Oct 7, 2021 at 14:25
  • Oh, ok, then I misunderstood. I can't remember successful attacks on fs drivers either.
    – Nobody
    Oct 7, 2021 at 18:42
0

I would assume in today's world, there is 0% chance of getting "infected" by opening a PDF or .xlsx or .doc file

I don't even know where to start in explaining how ludicrous that sentiment is.

Just look up "Excel VBA exploits"

There is literally an article named "MALICIOUS MACROS FOR SCRIPT KIDDIES"

With minimal effort even the most inexperienced person can craft and send you a malicious file.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.