2

Take a PDF, copy all, paste it into a .rtf document in textedit, --> make plain text. will this remove/nullify any malware from/in the pdf? In other words, if I open the PDF on one machine and convert it to plain text as such and then send the plain text file to a new machine, the new machine will not be at risk?

  • 2
    Yes, IF only the plain text file is transmitted to the new machine, the new machine is not at risk. HOWEVER; how will you know that the PDF-opening machine isn't adding an additional payload to your USB drive, or to the email you send, or isn't trying to brute-force the new machine's admin password, etc. etc.? That very transfer gets more interesting, since they shouldn't be on the same network. – Anti-weakpasswords Jan 11 '15 at 8:42
  • So, would it be best to open it in a browser and copy from there (as opposed to opening it with Adobe acrobat?) – user0 Jan 11 '15 at 18:36
  • Wouldn't you see the extra file added to the USB? Is there an easy way to check the USB for the payload? – user0 Jan 11 '15 at 18:36
3

As soon as you open the pdf to copy its contents and if there is any exploit present then it is going to be executed if your pdf reader is vulnerable to arbitrary code execution vulnerability and then it will infect all your files or just open up a backdoor.

If you want to open such pdf files create a virtual machine using vmware workstation put the pdf in a virtual machine and open it with updated pdf reader like adobe reader then you can copy and paste the contents of pdf file in a guest machine (virtual machine) to a text file in a host machine.

If you copy the (text) contents of pdf into a txt file then the malware won't work.

  • 5
    Adobe PDF reader would be the LAST product I'd use. That's actually where all the vulnerabilities exist. Adobe is a bit of a poster boy for vulnerable code. – Steve Sether Jan 10 '15 at 22:00
  • Thank you, you've gotten at what I was trying to ask. I was wondering whether the converted file would then be dangerous. – user0 Jan 11 '15 at 3:32
  • On Windows, could you open it safely in Sandboxie? – aliteralmind Jan 11 '15 at 3:39
  • @SteveSether: With all due respect, but do you really believe that other PDF viewers are not vulnerable??? – Max Wyss Jan 12 '15 at 23:11
  • 1
    @MaxWyss I believe security is always a matter of playing the odds. A program that's shown to be vulnerable time and time again isn't one you should trust. 20 years ago sendmail had a horrible, horrible reputation and had a vulnerability a week. Many people abandoned it, and looked for more secure alternatives like postfix and qmail. Both those programs have had far better reputations than sendmail. I think you need to understand security is never binary, it's analog. Things aren't vulnerable or invulnerable, they're just risky or less risky. – Steve Sether Jan 12 '15 at 23:17
1

Saying that a file is malicious or not has nothing to do with its extension. Rather the application with which it is opened will be the vector of the malware that is emebded within the file or not, depending if this application suffers from the vulnerability the malware is targetting.

When you open a PDF file, you are going to be infected if your Acrobate Reader (check the security bulletin) version is vulnerable to the malicious content the file embeds, in which case your question does not make a sense.

But if you mean if the operation of savng just the plain text of your PDF file into an other file with a different extension will or not remove the malware from your PDF file then the answer is (absolutely) NO. But if you mean if the produced file in which you copied the plain text is safe or not, then it can infected too especially if you have on your computer malware that is listening to COP/PAST events or to its equivalent functions and triggers malicious activities on your computer that can have different impacts.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.