Question Can be Linux be infected with a PDF file ?

[Manuel Jordan]

Hello Friends

According with your experience, considering:

• If a PDF file is infected by a virus/malware/trojan etc and if it is opened in Linux

Question

• Can be Linux be infected with a PDF file?

Yes, I know that kind of programs are designed to attack Windows but I want to know the probability for Linux

Thanks in advance

 

[USAFRet]

Linux is not immune to virus.
A virus targeted to the Linux platform can, indeed, do nasty things.

How it is delivered is meaningless.
It might be a PDF.

 

[Manuel Jordan]

What software exists for Linux to scan a PDF file?

How to know if is infected with something?

 

[Grobe]

Assuming you have a suspect pdf file - have you tried to upload it to virustotal.com ?

 

[Manuel Jordan]

Thanks for the replies

USAFRet

Linux is not immune to virus.
A virus targeted to the Linux platform can, indeed, do nasty things.
How it is delivered is meaningless.
It might be a PDF.

Agree.


Grobe

Assuming you have a suspect pdf file - have you tried to upload it to virustotal.com ?

The problem is that the PDF files have sensitive data, so is not possible "share it" in the web

 

[USAFRet]

The problem is that the PDF files have sensitive data, so is not possible "share it" in the web

Scrub the sensitive data, and then upload it.

Where did the PDF come from?
Known collaborator?

 

[Manuel Jordan]

Scrub the sensitive data

How if it can't be opened from the beginning?

Where did the PDF come from?
Known collaborator?

From the labs of the university, being public by any student and others pdfs come from a worker in a company

 

[USAFRet]

How if it can't be opened from the beginning?

Open a copy of it, in a VM.

 

[USAFRet]

From the labs of the university, being public by any student and others pdfs come from a worker in a company

Talk to other people in your realm.
Has anyone else had a problem with it?

 

[Manuel Jordan]

Open a copy of it, in a VM.

I am going to create a post about that, just to avoid problems:

Talk to other people in your realm.

Is not possible

Has anyone else had a problem with it?

Unknown

 

[USAFRet]

Or, instead of a VM, a sacrificial PC, that can be easily wiped and recovered.

 

[JayGau]

Why do you suspect the file is infected? And moreover, why do you think it's infected by a Linux malware?

Malwares are just programs and like any programs, they are not compatible with platforms they were not coded to run on. It's why Linux infections are rare: virus programmers prefer spending their time on codes designed for more widely used OS like Windows.

Anyways, you could install and scan your pdf with ClamAV. Some instructions here:

https://askubuntu.com/questions/250290/how-do-i-scan-for-viruses-with-clamav

 

[Manuel Jordan]

USAFRet

Or, instead of a VM, a sacrificial PC, that can be easily wiped and recovered.

Agree, It is the "worst" scenario

JayGau

Why do you suspect the file is infected?

Because it is was accessed in a public place (in the university) and in the other case just to avoid problems

And moreover, why do you think it's infected by a Linux malware?

Normally that kind of bad programs are designed to attack more Windows. But I don't want put in risk either a laptop or PC Desktop in Linux "easily".

Malwares are just programs and like any programs, they are not compatible with platforms they were not coded to run on

But exists the risk to attack Linux ... and even macOS too.

It's why Linux infections are rare: virus programmers prefer spending their time on codes designed for more widely used OS like Windows.

Agree ... but is not necessary take a risk

Anyways, you could install and scan your pdf with ClamAV. Some instructions here:
https://askubuntu.com/questions/250290/how-do-i-scan-for-viruses-with-clamav

Huge thanks for that suggestion and link

 

[USAFRet]

1. You are not the only or first person to access and open that file.
Being on a university resource, if it were malicious, someone would have said something and had it taken down.

2. Most public resources like this have their own AV solution in place, to detect and eradicate malicious files being uploaded.

 

[Manuel Jordan]

1. You are not the only or first person to access and open that file.
Being on a university resource, if it were malicious, someone would have said something and had it taken down.

For a better understanding:

1. A student is the owner of a PDF file
2. The student must do his course by 2 hrs in the laboratory
3. The laboratory and any machine is accessed by more of 100 students from many grades
4. So the PC even if is "frozen" sometimes is formatted by virus. Of course the antivirus failed.
5. The PDF file arrives to the PC Desktop of the laboratory through either a pendrive or downloaded by email
6. The PDF file is opened to read and to be edited ... finally saved ...

Later it must be opened in other place. Therefore is not an option harm other laptop/pc.

 

[USAFRet]

For a better understanding:

1. A student is the owner of a PDF file
2. The student must do his course by 2 hrs in the laboratory
3. The laboratory and any machine is accessed by more of 100 students from many grades
4. So the PC even if is "frozen" sometimes is formatted by virus. Of course the antivirus failed.
5. The PDF file arrives to the PC Desktop of the laboratory through either a pendrive or downloaded by email
6. The PDF file is opened to read and to be edited ... finally saved ...

Later it must be opened in other place. Therefore is not an option harm other laptop/pc.

Yes.

And a LOT of places like this have an AV procedure in place.
Anything uploaded is scanned on the upload. And if it finds something malicious, it is flagged/prevented/whatever.

 

[USAFRet]

But as mentioned above, ClamAV in your Linux system.

 

[Manuel Jordan]

And a LOT of places like this have an AV procedure in place.
Anything uploaded is scanned on the upload. And if it finds something malicious, it is flagged/prevented/whatever.

Yes, it seems is mandatory use the VM due the sensitive data, so it must not be public

But as mentioned above, ClamAV in your Linux system.

Yes. It is on the todo list