0

I recently started using Firefox for Android and saw I can download pages as PDF and near every image or video for any site and I'm using that quite a lot so what is the risk of downloading such things from websites?

Lets say I download an image with embedded malicious code? Will malicious JavaScript or others be downloaded when I save an page as PDF? I only open my PDFs via Google Drive built in support if that matters.

  • Copyright issues... not a security risk in itself, but still worth considering. When you scrape a site, you are leaving yourself open to all of the vulnerabilities in that site. – KingJohnno Jan 23 '15 at 15:04
  • I'm not downloading anything to use commercially or anything like that just for personal use.So copyright is not an issue – Freedo Feb 6 '15 at 21:57
5

In general, no: you should not be excessively worried about such an attack. To exploit this would require a bad guy to figure out a way to embed malicious code in their images, videos (or whatever) that activates after that image (or whatever) has been converted to a PDF and is then viewed.

Bear in mind that the thing doing the to-PDF conversion in this scenario is your phone: you would want to be much less trusting of a PDF generated by a third party.

2

There used to be a danger in downloading and running content locally in Internet Explorer 3 and earlier. Microsoft introduced Mark of the Web in IE4 that would make a locally ran website run in the security zone context from which it had been downloaded rather than in the context of the local machine (think file:/// rather than http://127.0.0.1).

JavaScript running locally would normally have full permissions to the file system under the context of the current user. However modern browsers now restrict this and Internet Explorer will prompt before allowing ActiveX content to run locally.

If you are printing the current page to PDF you should be fine. There is no extra danger of things executing as the browser is only printing what it already has rendered.

Regarding other files, this depends on how you are doing it and the maliciousness of that particular site you are downloading from. If you are using some sort of spidering tool a malicious page might reference a link to a trojan in the form <a href="page/trojan.exe">Click Me!</a>. Although these links are now treaty more securely so you shouldn't be able to execute them without a prompt, you would still be downloading the executable to your machine. Try to be as careful as possible and review whether the particular method you are using to download would be vulnerable to this.

1

It depends on what site you visit. Not everything you're downloading is malicious or vice versa.

www.netcraft.com provides service for blocking URL against known malware/phishing sites you can add this toolbar to your browser. This mitigates risk to a extend.

Netcraft

Hope this helps.

  • Between you and me i heard someone might want to download videos or images from porn sites, or just like to save pages as pdf for later use without internet access, and i don't think that using the extension from a know data-mining company is good at all, they are probably using you to track the sites you visit – Freedo Feb 6 '15 at 22:16

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.