Sometimes I have to open files (doc, zip, txt, pdf and some other) downloaded from the Internet (from unproven sites) on my computer.

How could I mitigate the risk and open them in a more or less secure way?

What types of files are more insecure than the other?

  • 2
    Voted as off-topic. This site is for IT professionals. For that type of question, I would recommend superuser.com – Olivier Lalonde Nov 13 '10 at 18:42
  • 2
    That is quite arguably - "off-topic". Topic is related to security, isn't it? IT security professionals deal also with end-user security policies. – anonymous Nov 13 '10 at 18:46
  • 3
    It's all about the way it's worded. First, OP didn't mention an OS which clearly hints he is not a professional and second, he plainly said "on my computer". – Olivier Lalonde Nov 13 '10 at 18:52
  • 3
    The discussion about wheter this is off-topic or on-topic should be moved to this meta question meta.security.stackexchange.com/questions/16/… – HoLyVieR Nov 13 '10 at 20:10
  • 1
    Specifically this question, if it were to be worded along the lines of "Which files are more insecure than others" in the context of handling them, either in code, on server, etc, and how do I handle them in my program,... this would be more on-topic. – AviD Nov 14 '10 at 2:05

What I can suggest:

  • open files inside VM's if it is possible, or, as @Henri said, use sandbox;
  • run AV software, at least it adds some security level;
  • you can use online AV scanner solutions like virustotal.com;
  • never trust any file from any source - friends can also be compromised, they can spread malware without their knowledge;
  • use updated software;

You should take into mind that software does not guarantee 100% protection. Only right policy and your experience can help to decrease risk and mitigate attacks.

  • No one would like to explain why this answer has gained -1 and @Henri's +1? – anonymous Nov 13 '10 at 19:06

The best way to open such files is by running them inside a sandbox. I would suggest a virtual machine.

Regarding which kind of files are safe, one can make two distinctions. In practice, files like zip, txt, jpg, png, etc are safe. Files like .exe, .msi, .com, .bat, .vbs, etc etc are unsafe. However, there is one big issuge with "safe" files, it is possible that due to an security vulnerability in the application that is used to open it, your systems security is compromised. An example is a recently released 0day for Acrobat Reader in combination with maliciously crafted pdfs.

  • 3
    This is not correct about file type extensions. Every file is considered to be harmful. For example, there exists so called "joiners" that allows to join picture with malware. User is not able to distinguish such file from unsafe. There are a lot of other examples how malware can be hidden. – anonymous Nov 13 '10 at 18:37
  • 1
    Yes, but given that your png viewer is safe, the malicious malware cannot be executed in the jpg...as far as i know. Im curious how the malware can be executed. – Henri Nov 14 '10 at 12:36
  • 1
    Thanks - good info on file types. The poster asked about .doc which is much trickier than most. Macros are a huge issue, though they are handled somewhat better now than in the past. Some discussion of how high the stakes are would make sense - i.e. if you're not a big target, then opening non-executables from not-too-shady sites on a completely updated system is not too dangerous, but if you are a big target, then 0-day attacks are a huge issue. – nealmcb Nov 26 '10 at 6:12
  • 1
    "given that your png viewer is safe" - Do they make safe ones? – Bradley Kreider Dec 14 '10 at 17:26
  • @rox0r: Does that strike you as likely? (Spoiler: no) cvedetails.com/vulnerability-list/vendor_id-7294/Libpng.html – Piskvor left the building Mar 10 '16 at 12:49

Sandboxie is what you are looking for (if you have windows). It's also free.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.