Viewing an infected file via FTP and code editor won't infect my PC right?

Question

My apologies this may sound like a paranoid question...

Recently my friend's website was infected by malware.

With her permission, I FTP into her account to have a look and found some malicious PHP files with Base64 (i think?) strings as well as TXT files that seem like Bash/Perl scripts calling "wget" on some server.

Question:

1. I won't get infected by viewing/editing those PHP and TXT files right? (I use FTP to download them and Aptana Studio 3 to view them).

2. I tried decoding the supposedly Base64 string using an online decoder. The operation failed (i.e. nothing was decoded). Nothing was also downloaded. Doing this won't cause my PC to be infected right?

Thanks guys.

Answer 1

Not so paranoid, Opening files in a text editor should be safe. Opening other file types is more risky, PDF's, images, office documents, have all had vulnerabilities where opening the file in certain viewers. Most text editors are simple enough that they have few vulnerabilities.

Ensure you never run the .php files, I would recommend changing the file extensions to .txt as soon as you download them.

Extra step for the paranoid, I would also recommend opening the files in a simple text editor, like notepad, editpad pro, sublime text or similar. The more complex and the more the editor understands the format the more likely it is that there is a bug which could be exploitable. This is much more a problem with complex formats like .doc or .pdf.

---

Further Response

There is the academic answer and the pragmatic answer and they are different.

The academic answer is that it is possible that opening any file in any editor could compromise your box. It is possible that copying the encode text into your paste buffer compromised your box. It is possible that pasting the encoded text into a website compromised your web browser which compromised your box.

The academic answer is not very helpful.

The pragmatic answer is, you'll be fine as long as you did not execute the files. Though the academic answer is factually correct, it is highly improbable the attacker the compromised the server either had access to or was willing to use zero-day attacks against desktop software.

For next time you are doing incident response or malware examination you should consider doing the work in a virtual machine, and discard any changes to the virtual machine once you are done with a piece of work.

Answer 2

As the data is embeded in a PHP script file, it is perfectly safe to download the file and edit in a script editor.

If you do manage to decode the obscured data, you do, of course, need to be careful how you handle that.

There is no danger to you or anyone else as long as you are not trying to interpret the data automatically. Even trying to interpret the obscured data by unencoding it will not present a particular danger though the resulting file might itself be dangerous depending on the file type resulting. PDF files can be dangerous if loaded into Adobe reader (use Ghost script or another simple reader if not sure, preferably in a throw-away VM), Image files can be dangerous due to possible bugs in the OS handling of images. Script files (PHP, PERL, etc.) are never dangerous unless executed.