Take a PDF, copy all, paste it into a .rtf document in textedit, --> make plain text. will this remove/nullify any malware from/in the pdf? In other words, if I open the PDF on one machine and convert it to plain text as such and then send the plain text file to a new machine, the new machine will not be at risk?
3
-
2Yes, IF only the plain text file is transmitted to the new machine, the new machine is not at risk. HOWEVER; how will you know that the PDF-opening machine isn't adding an additional payload to your USB drive, or to the email you send, or isn't trying to brute-force the new machine's admin password, etc. etc.? That very transfer gets more interesting, since they shouldn't be on the same network.– Anti-weakpasswordsJan 11, 2015 at 8:42
-
So, would it be best to open it in a browser and copy from there (as opposed to opening it with Adobe acrobat?)– Sam WeisenthalJan 11, 2015 at 18:36
-
Wouldn't you see the extra file added to the USB? Is there an easy way to check the USB for the payload?– Sam WeisenthalJan 11, 2015 at 18:36
Add a comment
|
2 Answers
As soon as you open the pdf to copy its contents and if there is any exploit present then it is going to be executed if your pdf reader is vulnerable to arbitrary code execution vulnerability and then it will infect all your files or just open up a backdoor.
If you want to open such pdf files create a virtual machine using vmware workstation put the pdf in a virtual machine and open it with updated pdf reader like adobe reader then you can copy and paste the contents of pdf file in a guest machine (virtual machine) to a text file in a host machine.
If you copy the (text) contents of pdf into a txt file then the malware won't work.
-
6Adobe PDF reader would be the LAST product I'd use. That's actually where all the vulnerabilities exist. Adobe is a bit of a poster boy for vulnerable code. Jan 10, 2015 at 22:00
-
Thank you, you've gotten at what I was trying to ask. I was wondering whether the converted file would then be dangerous. Jan 11, 2015 at 3:32
-
-
@SteveSether: With all due respect, but do you really believe that other PDF viewers are not vulnerable???– Max WyssJan 12, 2015 at 23:11
-
1@MaxWyss I believe security is always a matter of playing the odds. A program that's shown to be vulnerable time and time again isn't one you should trust. 20 years ago sendmail had a horrible, horrible reputation and had a vulnerability a week. Many people abandoned it, and looked for more secure alternatives like postfix and qmail. Both those programs have had far better reputations than sendmail. I think you need to understand security is never binary, it's analog. Things aren't vulnerable or invulnerable, they're just risky or less risky. Jan 12, 2015 at 23:17
Saying that a file is malicious or not has nothing to do with its extension. Rather the application with which it is opened will be the vector of the malware that is emebded within the file or not, depending if this application suffers from the vulnerability the malware is targetting.
When you open a PDF file, you are going to be infected if your Acrobate Reader (check the security bulletin) version is vulnerable to the malicious content the file embeds, in which case your question does not make a sense.
But if you mean if the operation of savng just the plain text of your PDF file into an other file with a different extension will or not remove the malware from your PDF file then the answer is (absolutely) NO. But if you mean if the produced file in which you copied the plain text is safe or not, then it can infected too especially if you have on your computer malware that is listening to COP/PAST events or to its equivalent functions and triggers malicious activities on your computer that can have different impacts.