Hacker News new | ask | show | jobs
by b0afc375b5 1298 days ago
Whenever I download untrusted pdfs I always upload them to virustotal. Does that help at all and if so, is it sufficient enough?
2 comments

It'll be sufficient for known malware. But if malware hasn't been identified yet, VirusTotal won't pick it up.

Is it possible that you can download malware and VirusTotal not pick it up? there's a small chance. But, in my estimation, no one is really going to burn a novel strain of malware on free ebooks. It's not targeted and that site isn't a good watering hole to deploy novel malware.

Novel strains of malware are usually reserved for specific targets. Unless you're a high profile target of an authoritarian government or known to have a high networth, I don't really think you're going to get hit with the novel stuff.

TL/DR: VirusTotal will probably be enough for the average user. But no one can guarantee safety when you're downloading random files on the internet.

Is pdf dangerous? I guess on linux canonical distributes latest, free-of-known-vulnerables evince, what about windows? One must upload every file?
There has been a case of confirmed code execution vulnerability in Evince in the past, in 2017:

* https://www.cvedetails.com/cve/CVE-2017-1000083/

As well as possible code execution vulnerabilities in Evince, in 2019 and 2011:

* https://www.cvedetails.com/cve/CVE-2019-1010006/

* https://www.cvedetails.com/cve/CVE-2011-5244/

* https://www.cvedetails.com/cve/CVE-2011-0433/

They have also had a command injection vulnerability, in 2017:

* https://www.cvedetails.com/cve/CVE-2017-1000159/

These and other reported security vulnerabilities for Evince are listed here:

* https://www.cvedetails.com/vulnerability-list/vendor_id-283/...

I think in the case of all software it is safest to assume that opening a file that you downloaded from the internet has the potential to do harm, regardless of whether you are using Linux, macOS, Windows, or some other operating system, and regardless of what software you use to read the file.

The best mitigation would be to keep a separate device that you use purely for unauthenticated internet browsing and opening files from the Internet. Never accessing any personal data on that device. In reality almost all of us will use the same devices for our personal files and data, and for browsing the internet and opening random files that we downloaded.

It is interesting to note that the statistics for known security vulnerabilities in Evince..

* https://www.cvedetails.com/product/23592/Gnome-Evince.html?v...

..pales in comparison to the statistics for known security vulnerabilities in Adobe Acrobat Reader:

* https://www.cvedetails.com/product/497/Adobe-Acrobat-Reader....

I wonder if it indicates that Evince is so much more secure than Acrobat Reader.. Or is it simply the case that Evince has not been subject to the level of scrutiny that Acrobat Reader has been? And if so, there might be more unknown security vulnerabilities lurking under the surface of Evince than in Acrobat Reader.

Check out DangerZone. It encodes a .pdf (and other formats) to image data then converts it back to .pdf, optionally preserving OCR'ed text, so that any potential executable code hidden within is lost. For further security, all operations run sandboxed.

https://github.com/freedomofpress/dangerzone

Thank you. Saved this comment.
One possibility is that Acrobat Reader is more forgiving of poorly-formed PDFs, as I’ve generally heard is the case, and that by allowing documents that don’t meet the (huge, probably also poorly-formed) standard they open themselves up to more security risks.